{"action":"Upgrade org.gluu:oxauth-common to 4.4.1 or later.","affected":[{"fixed":"4.4.1","introduced":"0"}],"component":"org.gluu:oxauth-common","cve_ids":["CVE-2022-36663"],"ecosystem":"Maven","exploited":false,"fixed_versions":["4.4.1"],"ghsa_id":"GHSA-hc94-9v26-gxwv","id":"tcs_01M5N909M5P9C2GGVT0JB6YFAS","modified_at":"2023-11-08T04:10:03.433086Z","published_at":"2022-09-07T00:01:50Z","references":["https://osv.dev/vulnerability/GHSA-hc94-9v26-gxwv","https://nvd.nist.gov/vuln/detail/CVE-2022-36663","https://github.com/GluuFederation/oxAuth/commit/58c4ac9bbf2addf4b419bf155de99db57a202f5c","https://github.com/GluuFederation/oxAuth","https://github.com/GluuFederation/oxAuth/releases/tag/4.4.1","https://gluu.org/gluu-4-4-1"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-hc94-9v26-gxwv","url":"https://osv.dev/vulnerability/GHSA-hc94-9v26-gxwv"}],"summary":"Gluu Oxauth before v4.4.1 vulnerable to Server-Side Request Forgery attacks via a crafted request_uri parameter"}