Skip to content
Fencer Vulns
critical 9.6

CVE-2018-15758 in the critical feed json

Privilege Escalation in spring-security-oauth2

published 2018-10-18 8 y ago modified 2026-06-17 4 mo ago also GHSA-h8w4-qv99-f7vj , EUVD-2018-0615

cvss
9.6
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.2%
EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval endpoint that can modify the previously saved authorization request and lead to a privilege escalation on the subsequent approval. This scenario can happen if the application is configured to use a custom approval endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and use a custom Approval Endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability does not expose applications that: Act in the role of an Authorization Server and use the default Approval Endpoint, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).

Patch / fix

  • maven org.springframework.security.oauth:spring-security-oauth2 2.0.16, 2.1.3, 2.2.3.RELEASE, 2.3.4.RELEASE
  • pivotal_software spring_security_oauth 2.0.16, 2.1.3, 2.2.3, 2.3.4

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-15758 updated cvss 6.4

spring-security-oauth: Privilege escalation by manipulating saved authorization request

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.15% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 9.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
NVD 3.0 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub 3.0 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.springframework.security.oauth:spring-security-oauth2
>=2.0.0, <2.0.16
>=2.1.0, <2.1.3
>=2.2.0, <2.2.3.RELEASE
>=2.3.0, <2.3.4.RELEASE
2.0.16
2.1.3
2.2.3.RELEASE
2.3.4.RELEASE

Affected products

  • Pivotal Spring Security OAuth

Classification

Weakness
  • CWE-269 Improper Privilege Management
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.