Search for packages
| purl | pkg:maven/org.springframework.security/spring-security-core@4.1.0.RELEASE |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2fan-h878-8faj
Aliases: CVE-2020-5408 GHSA-2ppp-9496-p23q |
Use of Insufficiently Random Values Spring Security uses a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack. |
Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-46dm-5t83-tyh6
Aliases: CVE-2016-5007 GHSA-8crv-49fr-2h6j |
Spring Security / MVC Path Matching Inconsistency This package rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences. |
Affected by 0 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-aygn-9njz-ybfh
Aliases: CVE-2016-9879 GHSA-v35c-49j6-q8hq |
Encoded "/" in path variables This package does not consider URL path parameters when processing security constraints.Users of IBM WebSphere Application Server `8.5.x` are known to be affected. Users of other containers that implement the Servlet specification may be affected. |
Affected by 3 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-h4kj-zdr8-wbdr
Aliases: CVE-2018-1199 GHSA-v596-fwhq-8x48 |
Improper Input Validation Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for `getPathInfo()` and some do not. Spring Security uses the value returned by `getPathInfo()` as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-vh4r-sk3t-eqe3
Aliases: CVE-2021-22112 GHSA-gq28-h5vg-8prx |
privilege escalation |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||