CVE-2015-5258: CSRF
Cross-site request forgery (CSRF) vulnerability in springframework-social before 1.1.3.
Other sources
It was found that when authorizing an application against an OAuth 2 API provider, Spring Social is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The attack involves a malicious user beginning an OAuth 2 authorization flow using a fake account with an OAuth 2 API provider, but completing it by tricking the victim into visiting the callback request in their browser. As a consequence, the attacker will have access to the victim's account on the vulnerable site by way of the fake provider account.
External Reference:
https://blog.srcclr.com/spring-social-core-vulnerability-disclosure/
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5258?
CVE-2015-5258 is classified as a moderate severity Cross-Site Request Forgery (CSRF) vulnerability.
How do I fix CVE-2015-5258?
To fix CVE-2015-5258, upgrade Spring Social to version 1.1.3 or later.
Which software versions are affected by CVE-2015-5258?
CVE-2015-5258 affects Spring Social versions prior to 1.1.3.
What kind of attack is CVE-2015-5258 associated with?
CVE-2015-5258 is associated with Cross-Site Request Forgery (CSRF) attacks.
Is CVE-2015-5258 a common vulnerability type?
Yes, Cross-Site Request Forgery (CSRF) vulnerabilities like CVE-2015-5258 are common in web applications that do not properly protect against unauthorized actions.