Aller au contenu
en Se connecter
9.1 Critique

CVE-2024-38821 Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under…

Description

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support

Produits et versions touchés

Produit Versions touchées Corrigé en
Spring 6.3 6.3.x → < 6.3.4 6.3.4
Spring 6.2 6.2.x → < 6.2.7 6.2.7
Spring 6.1 6.1.x → < 6.1.11 6.1.11
Spring 6.0 6.0.x → < 6.0.13 6.0.13
Spring 5.8 5.8.x → < 5.8.15 5.8.15
Spring 5.7 5.7.x → < 5.7.13 5.7.13
webflux 6.3 6.3x → < 6.3.4 6.3.4
webflux 6.2 6.2x → < 6.2.7 6.2.7
webflux 6.1 6.1x → < 6.1.11 6.1.11
Afficher les 3 autres branches
Produit Versions touchées Corrigé en
webflux 6.0 6.0x → < 6.0.13 6.0.13
webflux 5.8 5.8x → < 5.8.15 5.8.15
webflux 5.7 5.7.x → < 5.7.13 5.7.13

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Spring

Les 4 CVE de Spring →
CVE-2024-38828 Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack 5.3 Moyenne CVE-2024-38816 Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to… 7.5 Élevée CVE-2024-22258 Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are… 6.1 Moyenne
Suivre cette CVE