CVE-2018-1256 is a high-severity (CVSS 8.1) vulnerability in io.pivotal.spring.cloud:spring-cloud-sso-connector. A fix is available for io.pivotal.spring.cloud:spring-cloud-sso-connector — see the affected versions and patch details below.
Issuer validation regression in Spring Cloud SSO Connector
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
io.pivotal.spring.cloud:spring-cloud-sso-connectorReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of the SSO Connector with tokens generated from another service plan.
Mitigation
Users of affected versions should apply the following mitigation:
- Releases that have fixed this issue include:</p><ul><li>Spring Cloud SSO Connector: 2.1.3</li></ul>
- Alternatively, you can perform <u>one</u> of the following workarounds:</p><ul><li>Bind your resource server to the SSO service plan via a service instance binding</li><li>Set “sso.connector.cloud.available=true” within your Spring application properties</li></ul>
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | io.pivotal.spring.cloud:spring-cloud-sso-connector | ≥ 2.1.2.RELEASE&&< 2.1.3.RELEASE | 2.1.3.RELEASEio.pivotal.spring.cloud:spring-cloud-sso-connector:2.1.3.RELEASE |
Affected Products
spring cloud sso connectorvmwareDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for io.pivotal.spring.cloud:spring-cloud-sso-connector, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update io.pivotal.spring.cloud:spring-cloud-sso-connector to 2.1.3.RELEASE or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2018-1256 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is CVE-2018-1256 in your dependencies?
Find it across Maven, including transitive dependencies.