{"action":"Upgrade org.springframework.security.oauth:spring-security-oauth2 to 1.0.5 (1.x) or 2.0.10 (2.x) or later.","affected":[{"fixed":"2.0.10","introduced":"2.0.0"},{"fixed":"1.0.5","introduced":"1.0.0"}],"component":"org.springframework.security.oauth:spring-security-oauth2","cve_ids":["CVE-2016-4977"],"ecosystem":"Maven","epss":0.79176,"exploited":false,"fixed_versions":["2.0.10","1.0.5"],"ghsa_id":"GHSA-7q9c-h23x-65fq","id":"tcs_01M5N8JY25S84957NFS6E3NYRT","modified_at":"2024-11-28T05:41:37.537630Z","published_at":"2018-10-18T18:06:22Z","references":["https://osv.dev/vulnerability/GHSA-7q9c-h23x-65fq","https://nvd.nist.gov/vuln/detail/CVE-2016-4977","https://github.com/advisories/GHSA-7q9c-h23x-65fq","https://lists.apache.org/thread.html/0841d849c23418c473ccb9183cbf41a317cb0476e44be48022ce3488@%3Cdev.fineract.apache.org%3E","https://lists.apache.org/thread.html/37d7e820fc65a768de3e096e98382d5529a52a039f093e59357d0bc0@%3Cdev.fineract.apache.org%3E","https://lists.apache.org/thread.html/5e6dd946635bbcc9e1f2591599ad0fab54f2dc3714196af3b17893f2@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/96c017115069408cec5e82ce1e6293facab398011f6db7e1befbe274@%3Cdev.fineract.apache.org%3E","https://pivotal.io/security/cve-2016-4977","http://www.openwall.com/lists/oss-security/2019/10/16/1"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-7q9c-h23x-65fq","url":"https://osv.dev/vulnerability/GHSA-7q9c-h23x-65fq"}],"summary":"Spring Security OAuth vulnerable to remote code execution (RCE) via specially crafted request using whitelabel views"}