Skip to content
Fencer Intel
medium 4.2

CVE-2019-11269 json

Open Redirector in spring-security-oauth2

published 7y ago modified 4mo ago also GHSA-mmf6-6597-3v6m , EUVD-2019-0551

cvss
4.2
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
8.9%
EPSS 8.9% chance of exploitation in 30 days, percentile 95%
public exploits
1
Exploit-DB

Summary

Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.

Patch / fix

  • maven org.springframework.security.oauth:spring-security-oauth 2.0.18.RELEASE, 2.1.5.RELEASE, 2.2.5.RELEASE, 2.3.6.RELEASE
  • Spring Spring Security OAuth v2.0.18.RELEASE, v2.1.5.RELEASE, v2.2.5.RELEASE, v2.3.6.RELEASE

Is CVE-2019-11269 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-11269 updated cvss 5.3

spring-security-oauth2: susceptible to an open redirector attack that can leak an authorization code

  • Red Hat Fuse 7 spring-security-oauth2 spring-security-oauth2
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (EDB-47000)

Exploit prediction

8.91% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-47000 Spring Security OAuth - Open Redirector webapps, 2019-06-17

CVSS scores

assigned by version score vector
CNA 3.0 4.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
NVD 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N
GitHub 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.springframework.security.oauth:spring-security-oauth
>=2.0.0.RELEASE, <2.0.18.RELEASE
>=2.1.0.RELEASE, <2.1.5.RELEASE
>=2.2.0.RELEASE, <2.2.5.RELEASE
>=2.3.0.RELEASE, <2.3.6.RELEASE
2.0.18.RELEASE
2.1.5.RELEASE
2.2.5.RELEASE
2.3.6.RELEASE

Affected products

  • Spring Spring Security OAuth

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.