Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of the SSO Connector with tokens generated from another service plan.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| io.pivotal.spring.cloud:spring-cloud-sso-connector(Maven) | 2.1.2.RELEASE | 2.1.3.RELEASE | N/A |
CVSS Metrics
