CVE-2019-3778

Reference Links

• https://exchange.xforce.ibmcloud.com/vulnerabilities/158330
• https://www.ibm.com/support/pages/node/6320835 (Advisory)
• http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html
• http://www.securityfocus.com/bid/107153
• https://pivotal.io/security/cve-2019-3778
• https://www.oracle.com/security-alerts/cpujan2021.html

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6320835

Frequently Asked Questions

• What is the severity of CVE-2019-3778?

  The severity of CVE-2019-3778 is high with a severity value of 7.4.

• How does CVE-2019-3778 allow phishing attacks?

  CVE-2019-3778 allows phishing attacks through an open redirector vulnerability that can leak an authorization code.

• Which versions of Spring Security OAuth are affected by CVE-2019-3778?

  Spring Security OAuth versions 2.3 to 2.3.5, 2.2 to 2.2.4, 2.1 to 2.1.4, and 2.0 to 2.0.17 are affected by CVE-2019-3778.

• How can a malicious user or attacker exploit CVE-2019-3778?

  A malicious user or attacker can craft a request to exploit the open redirector vulnerability in CVE-2019-3778.

• Where can I find more information about CVE-2019-3778?

  You can find more information about CVE-2019-3778 at the following references: [Packet Storm Security](http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html), [SecurityFocus](http://www.securityfocus.com/bid/107153), [Pivotal](https://pivotal.io/security/cve-2019-3778).