Skip to content
Fencer Intel
medium 6.5

CVE-2019-3778 json

Open Redirect in spring-security-oauth2

published 7y ago modified 4mo ago also GHSA-77rv-6vfw-x4gc , EUVD-2019-0373

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
16.6%
EPSS 16.6% chance of exploitation in 30 days, percentile 97%
public exploits
1
Exploit-DB

Summary

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).

Patch / fix

  • maven org.springframework.security.oauth:spring-security-oauth 2.0.17.RELEASE, 2.1.4.RELEASE, 2.2.4.RELEASE, 2.3.5.RELEASE
  • maven org.springframework.security.oauth:spring-security-oauth2 2.0.17.RELEASE, 2.1.4.RELEASE, 2.2.4.RELEASE, 2.3.5.RELEASE
  • Spring Spring Security OAuth 2.0.17.RELEASE, 2.1.4.RELEASE, 2.2.4.RELEASE, 2.3.5.RELEASE

Is CVE-2019-3778 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-3778 updated cvss 5.3

spring-security-oauth2: Open redirect via the "redirect_uri" parameter

  • Red Hat Fuse 7 spring-security-oauth2 spring-security-oauth2
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (EDB-47000)

Exploit prediction

16.60% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-47000 Spring Security OAuth - Open Redirector webapps, 2019-06-17

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.springframework.security.oauth:spring-security-oauth
<2.0.17.RELEASE
>=2.1.0.RELEASE, <2.1.4.RELEASE
>=2.2.0.RELEASE, <2.2.4.RELEASE
>=2.3.0.RELEASE, <2.3.5.RELEASE
2.0.17.RELEASE
2.1.4.RELEASE
2.2.4.RELEASE
2.3.5.RELEASE
maven org.springframework.security.oauth:spring-security-oauth2
<2.0.17.RELEASE
>=2.1.0.RELEASE, <2.1.4.RELEASE
>=2.2.0.RELEASE, <2.2.4.RELEASE
>=2.3.0.RELEASE, <2.3.5.RELEASE
2.0.17.RELEASE
2.1.4.RELEASE
2.2.4.RELEASE
2.3.5.RELEASE

Affected products

  • Spring Spring Security OAuth

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.