Description
Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of the SSO Connector with tokens generated from another service plan.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pivotal | Spring Cloud SSO Connector | 2.1.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.pivotal.spring.cloud:spring-cloud-sso-connector | >= 2.1.2.RELEASE, < 2.1.3.RELEASE | 2.1.3.RELEASE | GHSA-q4q2-93pw-qwgf |