Pivotal Software Spring Security OAuth vulnerabilities

4 CVEs affecting Pivotal Software Spring Security OAuth, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-11269, published 2019-06-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-3778, published 2019-03-07. Medium severity, CVSS 6.5. EPSS: 16.6% chance of exploitation in the next 30 days. Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector…
CVE-2018-1260, published 2018-05-11. Critical severity, CVSS 9.8. EPSS: 10.8% chance of exploitation in the next 30 days. Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A…
CVE-2019-11269, published 2019-06-12. Medium severity, CVSS 5.4. EPSS: 8.9% chance of exploitation in the next 30 days. Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector…
CVE-2018-15758, published 2018-10-18. High severity, CVSS 8.1. EPSS: 2.2% chance of exploitation in the next 30 days. Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege…