CVE-2018-1256

Name of the Vulnerable Software and Affected Versions Spring Cloud SSO Connector version 2.1.2

Description The issue is related to a regression in the Spring Cloud SSO Connector that disables issuer validation in resource servers not bound to the SSO service. This allows a remote attacker to authenticate to unbound resource servers using tokens generated from another service plan in PCF deployments with multiple SSO service plans.

Recommendations For Spring Cloud SSO Connector version 2.1.2, update to version 2.1.3 to resolve the issue. Alternatively, bind your resource server to the SSO service plan via a service instance binding. Alternatively, set sso.connector.cloud.available=true within your Spring application properties.