8.2
High
CVE-2024-22257 In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions…
Description
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Security | Versions not published | |
| spring_security 6.2 | 6.2.0 → 6.2.2 | No fix stated |
| spring_security 6.1 | 6.1.0 → 6.1.7 | No fix stated |
| spring_security 6.0 | 6.0.0 → 6.0.9 | No fix stated |
| spring_security 5.8 | 5.8.0 → 5.8.10 | No fix stated |
| spring_security 5.7 | 5.7.0 → 5.7.11 | No fix stated |
References
- spring.io spring.io
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of Spring Security
The 10 CVEs of Spring Security →
CVE-2023-34042
The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were …
4.1
Medium
CVE-2023-34034
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between…
9.1
Critical
CVE-2023-34035
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to…
7.3
High
CVE-2023-20862
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the…
6.3
Medium