CVE-2019-11272 PlaintextPasswordEncoder authenticates encoded passwords that are null

2019-06-2000:00:00

CWE-287

pivotal

www.cve.org

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

35.4%

JSON

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of “null”.

CNA Affected

[
  {
    "product": "Spring Security",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "4.2.13.RELEASE",
        "status": "affected",
        "version": "4.2",
        "versionType": "custom"
      }
    ]
  }
]