{"action":"Upgrade org.springframework.security.oauth:spring-security-oauth2 to 2.0.17.RELEASE (2.0.x), 2.1.4.RELEASE (2.1.x), 2.2.4.RELEASE (2.2.x) or 2.3.5.RELEASE (2.3.x) or later.","affected":[{"fixed":"2.0.17.RELEASE","introduced":"0"},{"fixed":"2.1.4.RELEASE","introduced":"2.1.0.RELEASE"},{"fixed":"2.2.4.RELEASE","introduced":"2.2.0.RELEASE"},{"fixed":"2.3.5.RELEASE","introduced":"2.3.0.RELEASE"}],"component":"org.springframework.security.oauth:spring-security-oauth2","cve_ids":["CVE-2019-3778"],"ecosystem":"Maven","epss":0.16596,"exploited":false,"fixed_versions":["2.0.17.RELEASE","2.1.4.RELEASE","2.2.4.RELEASE","2.3.5.RELEASE"],"ghsa_id":"GHSA-77rv-6vfw-x4gc","id":"tcs_01M5N8HTG6GD92JPHKQA8T7QCM","modified_at":"2024-02-16T08:19:08.896590Z","published_at":"2019-03-14T15:39:30Z","references":["https://osv.dev/vulnerability/GHSA-77rv-6vfw-x4gc","https://nvd.nist.gov/vuln/detail/CVE-2019-3778","https://github.com/spring-attic/spring-security-oauth","https://pivotal.io/security/cve-2019-3778","https://web.archive.org/web/20200227084837/http://www.securityfocus.com/bid/107153","https://www.oracle.com/security-alerts/cpujan2021.html","http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-77rv-6vfw-x4gc#Maven/org.springframework.security.oauth:spring-security-oauth2","url":"https://osv.dev/vulnerability/GHSA-77rv-6vfw-x4gc"}],"summary":"spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability"}