CyberRota Analysis
AI-GeneratedThe Spring Authorization Server's default consent page is vulnerable due to improper HTML entity encoding of user-controlled values, allowing attackers to inject malicious content into OAuth2 authorization requests. This could lead to cross-site scripting (XSS) attacks, compromising user data and potentially allowing unauthorized actions. Organizations utilizing Spring Authorization Server versions 1.4.0 to 1.5.8 should prioritize patching this vulnerability to safeguard their applications and users.
Original NVD Description
Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user. Spring Authorization Server 1.5.0 - 1.5.8 Spring Authorization Server 1.4.0 - 1.4.11
Related CVEs
Other vulnerabilities affecting the same vendor(s)