CVE-2024-22234

En Spring Security, versiones 6.1.x anteriores a 6.1.7 y versiones 6.2.x anteriores a 6.2.2, una aplicación es vulnerable a un control de acceso roto cuando utiliza directamente el método AuthenticationTrustResolver.isFullyAuthenticated(Authentication). Específicamente, una aplicación es vulnerable si: * La aplicación usa AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directamente y se le pasa un parámetro de autenticación nulo, lo que genera un valor de retorno verdadero erróneo. Una aplicación no es vulnerable si se cumple alguna de las siguientes condiciones: * La aplicación no utiliza AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directamente. * La aplicación no pasa nulo a AuthenticationTrustResolver.isFullyAuthenticated * La aplicación solo usa isFullyAuthenticated a través de Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html o HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html

A vulnerability was found in Spring Security. This issue may lead to Broken Access Control, allowing a malicious user to impact the Confidentiality and Integrity of an application or server. This requires the application to use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and have a null authentication parameter passed to it, resulting in an erroneous true return value.

In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. Specifically, an application is vulnerable if: * The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value. An application is not vulnerable if any of the following is true: * The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly. * The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated * The application only uses isFullyAuthenticated via Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html or HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html