description: When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.
problem types: Remote Code Execution
affected:
{
product: Spring Security OAuth
vendor: Pivotal
versions:
status: affected, version: 2.0.0 to 2.0.9
status: affected, version: 1.0.0 to 1.0.5
}