Description (CNA)
Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients. Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant. An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Spring / Spring | affected 1.0.x before 1.0.6; affected 1.1.x before 1.1.6; affected 1.2.x before 1.2.3 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.