CVE-2018-1256 | THREATINT

Assigner	dell
Reserved	2017-12-06
Published	2018-05-07
Updated	2024-09-17

Description

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of the SSO Connector with tokens generated from another service plan.

Product status

2.1.2

affected

References

https://pivotal.io/security/cve-2018-1256

cve.org CVE-2018-1256

nvd.nist.gov CVE-2018-1256

Download JSON

https://cve.threatint.com/CVE/CVE-2018-1256

Support options

Helpdesk Telegram

Subscribe to our newsletter to learn more about our work.