Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-238s-fv2m-u3bp

Summary

Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated
In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method.

Specifically, an application is vulnerable if:

*  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value.


An application is not vulnerable if any of the following is true:

*  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly.
*  The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated
*  The application only uses isFullyAuthenticated via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html

Aliases

alias	CVE-2024-22234

alias	GHSA-w3w6-26f2-p474

Fixed_packages

url	pkg:maven/org.springframework.security/spring-security-core@6.1.7
purl	pkg:maven/org.springframework.security/spring-security-core@6.1.7
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@6.1.7

url	pkg:maven/org.springframework.security/spring-security-core@6.2.2
purl	pkg:maven/org.springframework.security/spring-security-core@6.2.2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@6.2.2

Affected_packages

url pkg:maven/org.springframework.security/spring-security-core@6.1.0

purl pkg:maven/org.springframework.security/spring-security-core@6.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-238s-fv2m-u3bp

vulnerability	VCID-bxsu-s2pg-8bbt

vulnerability	VCID-gmgk-38nq-mkfb

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@6.1.0

url pkg:maven/org.springframework.security/spring-security-core@6.2.0

purl pkg:maven/org.springframework.security/spring-security-core@6.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-238s-fv2m-u3bp

vulnerability	VCID-p8md-ykt2-zyav

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@6.2.0

References

reference_url	https://github.com/spring-projects/spring-security
reference_id
reference_type
scores
url	https://github.com/spring-projects/spring-security

reference_url	https://github.com/spring-projects/spring-security/commit/750cb30ce44d279c2f54c845d375e6a58bded569
reference_id
reference_type
scores
url	https://github.com/spring-projects/spring-security/commit/750cb30ce44d279c2f54c845d375e6a58bded569

reference_url	https://security.netapp.com/advisory/ntap-20240315-0003
reference_id
reference_type
scores
url	https://security.netapp.com/advisory/ntap-20240315-0003

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2024-22234
reference_id	CVE-2024-22234
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2024-22234

reference_url	https://spring.io/security/cve-2024-22234
reference_id	CVE-2024-22234
reference_type
scores
url	https://spring.io/security/cve-2024-22234

reference_url	https://github.com/advisories/GHSA-w3w6-26f2-p474
reference_id	GHSA-w3w6-26f2-p474
reference_type
scores
url	https://github.com/advisories/GHSA-w3w6-26f2-p474

Weaknesses

cwe_id	284
name	Improper Access Control
description	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-238s-fv2m-u3bp

Vulnerability Instance