8.2
Élevée
CVE-2024-22257 In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions…
Description
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Security | Versions non publiées | |
| spring_security 6.2 | 6.2.0 → 6.2.2 | Pas de correctif indiqué |
| spring_security 6.1 | 6.1.0 → 6.1.7 | Pas de correctif indiqué |
| spring_security 6.0 | 6.0.0 → 6.0.9 | Pas de correctif indiqué |
| spring_security 5.8 | 5.8.0 → 5.8.10 | Pas de correctif indiqué |
| spring_security 5.7 | 5.7.0 → 5.7.11 | Pas de correctif indiqué |
Autres CVE de Spring Security
Les 10 CVE de Spring Security →
CVE-2023-34042
The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were …
4.1
Moyenne
CVE-2023-34034
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between…
9.1
Critique
CVE-2023-34035
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to…
7.3
Élevée
CVE-2023-20862
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the…
6.3
Moyenne