CVE-2024-22258
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
20/03/2024
Last modified:
05/12/2024
Description
Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.<br />
<br />
Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant.<br />
<br />
An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.<br />
<br />
Impact
Base Score 3.x
6.10
Severity 3.x
MEDIUM