Published: 23/02/2021 Updated: 02/12/2022

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

CVSS v3 Base Score: 9.1 | Impact Score: 5.2 | Exploitability Score: 3.9

VMScore: 570

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect up to and including 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in which HTTP request parameters affect an authorizationRequest.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mitreid connect

exploits CVE DESCRIPTION LINK CVE-2021-27582 MITREid-Connect-mass-assignment(autobinding) githubcom/FB-Sec/Translation/blob/main/OAuth%E9%9A%90%E8%97%8F%E6%94%BB%E5%87%BB%E9%9D%A2%E5%88%86%E6%9E%90/OAuth%E9%9A%90%E8%97%8F%E6%94%BB%E5%87%BB%E9%9D%A2%E5%88%86%E6%9E%90md CVE-2021-26715 MITREid-Connect-SSRF githubcom/FB-Sec/Translation/blob/main/OAuth%E9

CWE-1321 http://agrrrdog.blogspot.com/2017/03/autobinding-vulns-and-spring-mvc.html https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/commit/7eba3c12fed82388f917e8dd9b73e86e3a311e4c https://portswigger.net/research/hidden-oauth-attack-vectors https://nvd.nist.gov https://github.com/FB-Sec/exploits

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2021-27582

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect