Cyber Resilience

CVE-2016-4977

Pivotal Spring Security Oauth 1.0.0 … 2.0.9

High EPSS
Published
25 May 2017
Modified
13 May 2026
Patch / advisory
View advisory
CVSS Score v3 8.8
Click a component to see what it means
Raw vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.79 99.6th percentile
Risk Priority 90 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2016-4977 is a high-severity an unspecified weakness vulnerability in Pivotal Spring Security Oauth. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the…

more

crafting of the value for response_type.

CWE(s)
CWE-19

Related Threats

CVEs Like This One

CVE-2023-34061Same vendor: Pivotal
CVE-2023-34054Same vendor: Pivotal
CVE-2023-20885Same vendor: Pivotal
CVE-2023-34062Same vendor: Pivotal
CVE-2016-3236Shared CWE-19
CVE-2023-39395Shared CWE-19
CVE-2025-20311Shared CWE-19
CVE-2012-5357Shared CWE-19
CVE-2016-2510Shared CWE-19
CVE-2026-28552Shared CWE-19

Affected Assets

pivotal
spring security oauth
1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References