{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T04:59:32.796","vulnerabilities":[{"cve":{"id":"CVE-2024-22258","sourceIdentifier":"security@vmware.com","published":"2024-03-20T04:15:08.600","lastModified":"2026-06-17T07:11:02.923","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.\n\nSpecifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant.\n\nAn application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.\n\n"},{"lang":"es","value":"Las versiones 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 y versiones anteriores no compatibles de Spring Authorization Server son susceptibles a un ataque de degradación de PKCE para clientes confidenciales. En concreto, una aplicación es vulnerable cuando un cliente confidencial utiliza PKCE para la concesión del código de autorización. Una aplicación no es vulnerable cuando un cliente público utiliza PKCE para la concesión del código de autorización."}],"affected":[{"source":"security@vmware.com","affectedData":[{"vendor":"Spring","product":"Spring","defaultStatus":"affected","packageName":"Spring Authorization Server","versions":[{"version":"1.0.x","lessThan":"1.0.6","versionType":"enterprise support only","status":"affected"},{"version":"1.1.x","lessThan":"1.1.6","versionType":"oss","status":"affected"},{"version":"1.2.x\t","lessThan":"1.2.3","versionType":"oss","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@vmware.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-08-02T19:20:26.714356Z","id":"CVE-2024-22258","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-470"}]}],"references":[{"url":"https://spring.io/security/cve-2024-22258","source":"security@vmware.com"},{"url":"https://spring.io/security/cve-2024-22258","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}