Description Preview
In Spring Security versions 5.7.x to 6.2.x, an application may be vulnerable to broken access control if it directly utilizes the AuthenticatedVoter#vote method with a null Authentication parameter. This vulnerability could potentially allow unauthorized access to protected resources due to improper handling of authentication checks.
Overview
This CVE (CVE-2024-22257) affects Spring Security versions 5.7.x to 6.2.x. The vulnerability is classified as a possible broken access control issue, with a CVSS v3.1 base score of 8.2, indicating a high severity level. The attack complexity is low, and the attack vector is through the network. The confidentiality impact is high, while the integrity impact is low. No privileges are required for exploitation, and user interaction is not necessary.
Remediation
To remediate this vulnerability, users of affected versions of Spring Security (5.7.x to 6.2.x) should upgrade to the patched versions:
- For versions 5.7.x, upgrade to version 5.7.12 or later.
- For versions 5.8.x, upgrade to version 5.8.11 or later.
- For versions 6.0.x, upgrade to version 6.0.9 or later.
- For versions 6.1.x, upgrade to version 6.1.8 or later.
- For versions 6.2.x, upgrade to version 6.2.3 or later.
It is recommended to apply the necessary security updates provided by the vendor to mitigate the risk of exploitation of this vulnerability.
References
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- ManufacturingManufacturing
- Public AdministrationPublic Administration
- Retail TradeRetail Trade
- Health Care & Social AssistanceHealth Care & Social Assistance
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Finance and InsuranceFinance and Insurance
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- Transportation & WarehousingTransportation & Warehousing
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- Other Services (except Public Administration)Other Services (except Public Administration)
- Wholesale TradeWholesale Trade
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- ConstructionConstruction
- Educational ServicesEducational Services
- InformationInformation
- MiningMining
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- UtilitiesUtilities
