CVE-2024-22258

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22258", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2024-01-08T18:43:15.943Z", "datePublished": "2024-03-20T03:58:13.125Z", "dateUpdated": "2024-12-05T20:31:25.882Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "packageName": "Spring Authorization Server", "product": "Spring", "vendor": "Spring", "versions": [{"lessThan": "1.0.6", "status": "affected", "version": "1.0.x", "versionType": "enterprise support only"}, {"lessThan": "1.1.6", "status": "affected", "version": "1.1.x", "versionType": "oss"}, {"lessThan": "1.2.3", "status": "affected", "version": "1.2.x\t", "versionType": "oss"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.</p><p>Specifically, an application is vulnerable when a <strong>Confidential Client</strong>&nbsp;uses PKCE for the Authorization Code Grant.</p><p>An application is not vulnerable when a <strong>Public Client</strong>&nbsp;uses PKCE for the Authorization Code Grant.</p><br>"}], "value": "Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.\n\nSpecifically, an application is vulnerable when a Confidential Client\u00a0uses PKCE for the Authorization Code Grant.\n\nAn application is not vulnerable when a Public Client\u00a0uses PKCE for the Authorization Code Grant.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-03-20T03:58:15.047Z"}, "references": [{"url": "https://spring.io/security/cve-2024-22258"}], "source": {"discovery": "UNKNOWN"}, "title": "CVE-2024-22258: PKCE Downgrade in Spring Authorization Server", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:33.663Z"}, "title": "CVE Program Container", "references": [{"url": "https://spring.io/security/cve-2024-22258", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-470", "lang": "en", "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-02T19:20:26.714356Z", "id": "CVE-2024-22258", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-05T20:31:25.882Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://spring.io/security/cve-2024-22258", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:33.663Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22258", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-02T19:20:26.714356Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-470", "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T19:20:31.997Z"}}], "cna": {"title": "CVE-2024-22258: PKCE Downgrade in Spring Authorization Server", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Spring", "product": "Spring", "versions": [{"status": "affected", "version": "1.0.x", "lessThan": "1.0.6", "versionType": "enterprise support only"}, {"status": "affected", "version": "1.1.x", "lessThan": "1.1.6", "versionType": "oss"}, {"status": "affected", "version": "1.2.x\t", "lessThan": "1.2.3", "versionType": "oss"}], "packageName": "Spring Authorization Server", "defaultStatus": "affected"}], "references": [{"url": "https://spring.io/security/cve-2024-22258"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.\n\nSpecifically, an application is vulnerable when a Confidential Client\u00a0uses PKCE for the Authorization Code Grant.\n\nAn application is not vulnerable when a Public Client\u00a0uses PKCE for the Authorization Code Grant.\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.</p><p>Specifically, an application is vulnerable when a <strong>Confidential Client</strong>&nbsp;uses PKCE for the Authorization Code Grant.</p><p>An application is not vulnerable when a <strong>Public Client</strong>&nbsp;uses PKCE for the Authorization Code Grant.</p><br>", "base64": false}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-03-20T03:58:15.047Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22258", "state": "PUBLISHED", "dateUpdated": "2024-12-05T20:31:25.882Z", "dateReserved": "2024-01-08T18:43:15.943Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2024-03-20T03:58:13.125Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "packageName": "Spring Authorization Server", "product": "Spring", "vendor": "Spring", "versions": [{"lessThan": "1.0.6", "status": "affected", "version": "1.0.x", "versionType": "enterprise support only"}, {"lessThan": "1.1.6", "status": "affected", "version": "1.1.x", "versionType": "oss"}, {"lessThan": "1.2.3", "status": "affected", "version": "1.2.x\t", "versionType": "oss"}]}], "source": "security@vmware.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.\n\nSpecifically, an application is vulnerable when a Confidential Client\u00a0uses PKCE for the Authorization Code Grant.\n\nAn application is not vulnerable when a Public Client\u00a0uses PKCE for the Authorization Code Grant.\n\n"}, {"lang": "es", "value": "Las versiones 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 y versiones anteriores no compatibles de Spring Authorization Server son susceptibles a un ataque de degradaci\u00f3n de PKCE para clientes confidenciales. En concreto, una aplicaci\u00f3n es vulnerable cuando un cliente confidencial utiliza PKCE para la concesi\u00f3n del c\u00f3digo de autorizaci\u00f3n. Una aplicaci\u00f3n no es vulnerable cuando un cliente p\u00fablico utiliza PKCE para la concesi\u00f3n del c\u00f3digo de autorizaci\u00f3n."}], "id": "CVE-2024-22258", "lastModified": "2026-06-17T07:11:02.923", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-22258", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-08-02T19:20:26.714356Z", "version": "2.0.3"}}]}, "published": "2024-03-20T04:15:08.600", "references": [{"source": "security@vmware.com", "url": "https://spring.io/security/cve-2024-22258"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://spring.io/security/cve-2024-22258"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-470"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}