漏洞标题
在使用spring-security进行JWT发行人验证时的授权绕过
漏洞描述信息
在使用spring-security进行JWT发行者验证时的授权绕过
CVSS信息
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
漏洞类别
N/A
漏洞标题
Authorization Bypass During JWT Issuer Validation with spring-security
漏洞描述信息
Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWTs with the malicious issuer URL that may be granted for the honest issuer.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Pivotal Spring Framework 安全漏洞
漏洞描述信息
Pivotal Spring Framework是美国Pivotal Software公司的一套开源的Java、Java EE应用程序框架。该框架可帮助开发人员构建高质量的应用。 Pivotal Spring Framework 5.1版本至5.1.1版本中对JWT发送者验证的过程存在安全漏洞。目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。
CVSS信息
N/A
漏洞类别
授权问题