« Volver al listado

CVE-2024-22258

Estado: AplazadaMedia (6.1)—

Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.

Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant.

An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Vmware — Authorization ServerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-22258",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22258",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-02T19:20:26.714356Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Spring",
          "product": "Spring",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.x",
              "lessThan": "1.0.6",
              "versionType": "enterprise support only"
            },
            {
              "status": "affected",
              "version": "1.1.x",
              "lessThan": "1.1.6",
              "versionType": "oss"
            },
            {
              "status": "affected",
              "version": "1.2.x\t",
              "lessThan": "1.2.3",
              "versionType": "oss"
            }
          ],
          "packageName": "Spring Authorization Server",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-03-20T04:15:08.600",
  "references": [
    {
      "url": "https://spring.io/security/cve-2024-22258",
      "source": "security@vmware.com"
    },
    {
      "url": "https://spring.io/security/cve-2024-22258",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-470"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.\n\nSpecifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant.\n\nAn application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.\n\n"
    },
    {
      "lang": "es",
      "value": "Las versiones 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 y versiones anteriores no compatibles de Spring Authorization Server son susceptibles a un ataque de degradación de PKCE para clientes confidenciales. En concreto, una aplicación es vulnerable cuando un cliente confidencial utiliza PKCE para la concesión del código de autorización. Una aplicación no es vulnerable cuando un cliente público utiliza PKCE para la concesión del código de autorización."
    }
  ],
  "lastModified": "2026-06-17T07:11:02.923",
  "sourceIdentifier": "security@vmware.com"
}