Aller au contenu
en Se connecter
9.1 Critique

CVE-2025-41232 Spring Security Aspects may not correctly locate method security annotations on private methods

Description

Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: * You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and * You have Spring Security method annotations on a private method In that case, the target method may be able to be invoked without proper authorization. You are not affected if: * You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or * You have no Spring Security-annotated private methods

Produits et versions touchés

Produit Versions touchées Corrigé en
Spring Security 6.4 6.4.x → < 6.4.6 6.4.6

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Spring Security

Les 29 CVE de Spring Security →
CVE-2026-59277 Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing… 3.7 Faible CVE-2026-59276 Several components in Spring Security compare security-sensitive values using standard string equality (String.equals())… 5.9 Moyenne CVE-2026-59270 Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative… 9.4 Critique CVE-2026-47877 Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding 8.2 Élevée
Suivre cette CVE