Aller au contenu
en Se connecter
Non notée

CVE-2021-22112 Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older…

Description

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.

Produits et versions touchés

Produit Versions touchées Corrigé en
Spring Security Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Spring Security

Les 10 CVE de Spring Security →
CVE-2024-22257 In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions… 8.2 Élevée CVE-2023-34042 The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were … 4.1 Moyenne CVE-2023-34034 Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between… 9.1 Critique CVE-2023-34035 Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to… 7.3 Élevée
Suivre cette CVE