CVE-2019-11272 PlaintextPasswordEncoder authenticates encoded passwords that are null

🗓️ 26 Jun 2019 14:06:15Reported by pivotalType

Spring Security vulnerability null password authenticatio

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: IBM Cognos Controller has addressed multiple vulnerabilities	2 Dec 202219:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)	12 Jan 202114:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator	13 May 202214:58	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)	24 Aug 202010:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling B2B Integrator vulnerable to multiple vulnerabilities due to Spring Security	13 May 202214:58	–	ibm
BDU FSTEC	The vulnerability of the PlaintextPasswordEncoder class implementation in the Java framework for securing Spring Security industrial applications allows a perpetrator to gain unauthorized access to protected information.	20 Aug 201900:00	–	bdu_fstec
CNVD	Pivotal Software Spring Security Authentication Vulnerability	24 Jun 201900:00	–	cnvd
Atlassian	BASM (Broken Authentication & Session Management) org.springframework.security:spring-security-core Dependency in Crucible Data Center and Server	12 Jun 202617:55	–	atlassian
CVE	CVE-2019-11272	26 Jun 201914:06	–	cve
Debian	[SECURITY] [DLA 1848-1] libspring-security-2.0-java security update	9 Jul 201906:25	–	debian

[
  {
    "product": "Spring Security",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "4.2.13.RELEASE",
        "status": "affected",
        "version": "4.2",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
pivotal	www.pivotal.io/security/cve-2019-11272
lists	www.lists.debian.org/debian-lts-announce/2019/07/msg00008.html

09 Jul 2019 08:06Current

7.2High risk

Vulners AI Score7.2

EPSS0.0137

CWE-287