CVE-2019-11269

FAUCET Score

CVE-2019-11269 is an open redirect vulnerability affecting Spring Security OAuth versions 2.3.6 and earlier, 2.2.5 and earlier, 2.1.5 and earlier, and 2.0.18 and earlier, as well as Oracle and Pivotal Banking Corporate Lending. An attacker can craft a malicious authorization request to redirect a user to an attacker-controlled URI, potentially leaking an authorization code. This vulnerability has a CVSS score of 5.4 (Medium) due to its network-based attack vector, low attack complexity, and potential for partial confidentiality and integrity impact. While there is no evidence of active exploitation, an ExploitDB entry (EDB-47000) exists, and it has a FAUCET Risk Score of 84/100, indicating a higher potential for exploitation despite limited community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 2.0.0, < 2.0.18CPE matchmatch criteria	cpe:2.3:a:pivotal_software:spring_security_oauth::::::::
		>= 2.1.0, < 2.1.5CPE matchmatch criteria	cpe:2.3:a:pivotal_software:spring_security_oauth::::::::
		>= 2.2.0, < 2.2.5CPE matchmatch criteria	cpe:2.3:a:pivotal_software:spring_security_oauth::::::::
		>= 2.3.0, < 2.3.6CPE matchmatch criteria	cpe:2.3:a:pivotal_software:spring_security_oauth::::::::
		14.1.0CPE matchmatch criteria	cpe:2.3:a:oracle:banking_corporate_lending:14.1.0:::::::*

CVSS Data

CVSS version used by this source: 3.0

4.2MEDIUM

CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

0.5

Impact Score

3.6

CvssVersion

3.0

Exploit Intelligence

EPSS Score

8.91%

Probability of exploitation in next 30 days

EPSS Percentile

94.7%

Percentile rank of EPSS score among Peer Group

As of 2026-07-25

Model: v2026.06.15

ExploitDB: EDB-47000 · Jun 17, 2019

This CVE's current EPSS score of 0.0891 is in the 98th percentile among its peer group of 26,219 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (4)

mavenpatch availablevia ghsa

Product: org.springframework.security.oauth:spring-security-oauthFixed in: 2.0.18.RELEASE

mavenpatch availablevia ghsa

Product: org.springframework.security.oauth:spring-security-oauthFixed in: 2.1.5.RELEASE

mavenpatch availablevia ghsa

Product: org.springframework.security.oauth:spring-security-oauthFixed in: 2.2.5.RELEASE

mavenpatch availablevia ghsa

Product: org.springframework.security.oauth:spring-security-oauthFixed in: 2.3.6.RELEASE

Vendor Advisories (2)

mavenGHSA-mmf6-6597-3v6mmedium

Open Redirect in Spring Security OAuth

Jun 13, 2019

redhatCVE-2019-11269Moderate

spring-security-oauth2: susceptible to an open redirector attack that can leak an authorization code

May 30, 2019

References

packetstormsecurity.com / files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html

Third Party AdvisoryVDB Entry

pivotal.io / security/cve-2019-11269

Vendor Advisory

oracle.com / security-alerts/cpujan2021.html

Third Party Advisory