CVSS: 7.5EPSS: 1%CPEs: 9EXPL: 0CVE-2018-1199 – spring-framework: Improper URL path validation allows for bypassing of security checks on static resources
https://notcve.org/view.php?id=CVE-2018-1199
16 Mar 2018 — Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path par... • https://access.redhat.com/errata/RHSA-2018:2405 • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2017-4995
https://notcve.org/view.php?id=CVE-2017-4995
27 Nov 2017 — An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets." Spring Security configures Jackson with global default typing enabled, which means that (through the previous exploit) arbitrary code could be executed if all of the following... • http://www.securityfocus.com/bid/99080 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 66EXPL: 0CVE-2016-5007
https://notcve.org/view.php?id=CVE-2016-5007
25 May 2017 — Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that... • http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 0CVE-2014-3527
https://notcve.org/view.php?id=CVE-2014-3527
25 May 2017 — When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request. This means if there are access control restrictions on which CAS services can authenticate to one another, those restrictions ca... • https://pivotal.io/security/cve-2014-3527 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 28EXPL: 0CVE-2016-9879 – Security: Improper handling of path parameters allows bypassing the security constraint
https://notcve.org/view.php?id=CVE-2016-9879
06 Jan 2017 — An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value retur... • http://www.securityfocus.com/bid/95142 • CWE-20: Improper Input Validation CWE-417: Communication Channel Errors •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2014-0097 – Spring Security 3.2.1 / 3.1.5 Authentication Bypass
https://notcve.org/view.php?id=CVE-2014-0097
12 Mar 2014 — The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password. El ActiveDirectoryLdapAuthenticator en Spring Security versiones de la 3.2.0 a la 3.2.1 y de la 3.1.0 a la 3.1.5 no chequea la longitud de la contraseña. Si el directorio permite enlaces anónimos entonces podría autenticar de forma incorrecta a un usuario que proporcion... • https://pivotal.io/security/cve-2014-0097 • CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 15EXPL: 0CVE-2012-5055 – Security: Ability to determine if username is valid via DaoAuthenticationProvider
https://notcve.org/view.php?id=CVE-2012-5055
05 Dec 2012 — DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests. DaoAuthenticationProvider en VMware SpringSource Spring Security antes de v2.0.8, v3.0.x antes de v3.0.8, y v3.1.x antes de v3.1.3 no comprueba la contraseña si el usuario no se encuentra, lo que hace qu... • http://support.springsource.com/security/CVE-2012-5055 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.6EPSS: 0%CPEs: 13EXPL: 0CVE-2011-2731
https://notcve.org/view.php?id=CVE-2011-2731
05 Dec 2012 — Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread. Condición de carrera en el mecanismo RunAsManager en Mware SpringSource Spring Security antes de v2.0.7 y v3.0.x antes de v3.0.6 almacena el objeto Authentication en el contexto de seguridad compartida, lo que permite a atacantes remotos ganar privilegios a travé... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 4.3EPSS: 6%CPEs: 13EXPL: 1CVE-2011-2732 – Spring Security - HTTP Header Injection
https://notcve.org/view.php?id=CVE-2011-2732
05 Dec 2012 — CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter. Vulnerabilidad de inyección de secuencias CRLF en la funcionalidad de logout en VMware SpringSource Spring Security antes de v2.0.7 y v3.0.x antes de v3.0.6 permite a atacantes remotos inyectar cabeceras HTTP de su elección y llevar a ... • https://www.exploit-db.com/exploits/36130 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 19%CPEs: 2EXPL: 1CVE-2011-2894 – Security: Chosen commands execution on the server (Framework) or authentication token bypass (Security) by objects de-serialization
https://notcve.org/view.php?id=CVE-2011-2894
04 Oct 2011 — Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang... • https://github.com/pwntester/SpringBreaker • CWE-502: Deserialization of Untrusted Data •