Search for packages
| purl | pkg:maven/org.springframework.security/spring-security-core@4.0.4.RELEASE |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1ccn-qeh9-vqgn
Aliases: CVE-2024-38827 GHSA-q3v6-hm2v-pw99 |
This advisory has been marked as False-Positive and removed The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-46dm-5t83-tyh6
Aliases: CVE-2016-5007 GHSA-8crv-49fr-2h6j |
Spring Security / MVC Path Matching Inconsistency This package rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences. |
Affected by 0 other vulnerabilities. Affected by 7 other vulnerabilities. |
|
VCID-p8md-ykt2-zyav
Aliases: CVE-2024-22257 GHSA-f3jh-qvm4-mg39 |
Erroneous authentication pass in Spring Security In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter. Specifically, an application is vulnerable if: The application uses AuthenticatedVoter directly and a null authentication parameter is passed to it resulting in an erroneous true return value. An application is not vulnerable if any of the following is true: * The application does not use AuthenticatedVoter#vote directly. * The application does not pass null to AuthenticatedVoter#vote. Note that AuthenticatedVoter is deprecated since 5.8, use implementations of AuthorizationManager as a replacement. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-szph-1zgk-a7dt
Aliases: CVE-2022-22976 GHSA-wx54-3278-m5g4 |
springframework: BCrypt skips salt rounds for work factor of 31 |
Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-vh4r-sk3t-eqe3
Aliases: CVE-2021-22112 GHSA-gq28-h5vg-8prx |
privilege escalation |
Affected by 0 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||