Search for packages
| purl | pkg:maven/org.springframework.security/spring-security-core@4.1.1.RELEASE |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1ccn-qeh9-vqgn
Aliases: CVE-2024-38827 GHSA-q3v6-hm2v-pw99 |
This advisory has been marked as False-Positive and removed The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-2fan-h878-8faj
Aliases: CVE-2020-5408 GHSA-2ppp-9496-p23q |
Use of Insufficiently Random Values Spring Security uses a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack. |
Affected by 4 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-aygn-9njz-ybfh
Aliases: CVE-2016-9879 GHSA-v35c-49j6-q8hq |
Encoded "/" in path variables This package does not consider URL path parameters when processing security constraints.Users of IBM WebSphere Application Server `8.5.x` are known to be affected. Users of other containers that implement the Servlet specification may be affected. |
Affected by 6 other vulnerabilities. Affected by 9 other vulnerabilities. |
|
VCID-h4kj-zdr8-wbdr
Aliases: CVE-2018-1199 GHSA-v596-fwhq-8x48 |
Improper Input Validation Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for `getPathInfo()` and some do not. Spring Security uses the value returned by `getPathInfo()` as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed. |
Affected by 1 other vulnerability. Affected by 4 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 7 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-p8md-ykt2-zyav
Aliases: CVE-2024-22257 GHSA-f3jh-qvm4-mg39 |
Erroneous authentication pass in Spring Security In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter. Specifically, an application is vulnerable if: The application uses AuthenticatedVoter directly and a null authentication parameter is passed to it resulting in an erroneous true return value. An application is not vulnerable if any of the following is true: * The application does not use AuthenticatedVoter#vote directly. * The application does not pass null to AuthenticatedVoter#vote. Note that AuthenticatedVoter is deprecated since 5.8, use implementations of AuthorizationManager as a replacement. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-szph-1zgk-a7dt
Aliases: CVE-2022-22976 GHSA-wx54-3278-m5g4 |
springframework: BCrypt skips salt rounds for work factor of 31 |
Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-vh4r-sk3t-eqe3
Aliases: CVE-2021-22112 GHSA-gq28-h5vg-8prx |
privilege escalation |
Affected by 0 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-46dm-5t83-tyh6 | Spring Security / MVC Path Matching Inconsistency This package rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences. |
CVE-2016-5007
GHSA-8crv-49fr-2h6j |