Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.springframework.security/spring-security-core@6.2.2
Typemaven
Namespaceorg.springframework.security
Namespring-security-core
Version6.2.2
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version6.2.3
Latest_non_vulnerable_version6.5.4
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-238s-fv2m-u3bp
vulnerability_id VCID-238s-fv2m-u3bp
summary 
Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated
In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method.

Specifically, an application is vulnerable if:

*  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value.


An application is not vulnerable if any of the following is true:

*  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly.
*  The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated
*  The application only uses isFullyAuthenticated via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html
references
0
reference_url https://github.com/spring-projects/spring-security
reference_id
reference_type
scores
url https://github.com/spring-projects/spring-security
1
reference_url https://github.com/spring-projects/spring-security/commit/750cb30ce44d279c2f54c845d375e6a58bded569
reference_id
reference_type
scores
url https://github.com/spring-projects/spring-security/commit/750cb30ce44d279c2f54c845d375e6a58bded569
2
reference_url https://security.netapp.com/advisory/ntap-20240315-0003
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20240315-0003
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-22234
reference_id CVE-2024-22234
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2024-22234
4
reference_url https://spring.io/security/cve-2024-22234
reference_id CVE-2024-22234
reference_type
scores
url https://spring.io/security/cve-2024-22234
5
reference_url https://github.com/advisories/GHSA-w3w6-26f2-p474
reference_id GHSA-w3w6-26f2-p474
reference_type
scores
url https://github.com/advisories/GHSA-w3w6-26f2-p474
fixed_packages
0
url pkg:maven/org.springframework.security/spring-security-core@6.1.7
purl pkg:maven/org.springframework.security/spring-security-core@6.1.7
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@6.1.7
1
url pkg:maven/org.springframework.security/spring-security-core@6.2.2
purl pkg:maven/org.springframework.security/spring-security-core@6.2.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@6.2.2
aliases CVE-2024-22234, GHSA-w3w6-26f2-p474
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-238s-fv2m-u3bp
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@6.2.2