CVE-2024-22234 CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated

🗓️ 20 Feb 2024 07:02:50Reported by vmwareType

Broken Access Control in Spring Security due to Direct Use of isFullyAuthenticated

Reporter	Title	Published	Views	Family All 29
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 1.14.4 IF001	14 May 202420:42	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	10 Apr 202409:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.7.5 addresses multiple security vulnerabilities.	3 Feb 202523:04	–	ibm
BDU FSTEC	The vulnerability of the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method in the Java framework for securing industrial applications by Spring Security allows attackers to influence the integrity and confidentiality of protected information.	27 Feb 202400:00	–	bdu_fstec
Circl	CVE-2024-22234	20 Feb 202408:22	–	circl
CNNVD	VMware Spring Security 安全漏洞	20 Feb 202400:00	–	cnnvd
CNVD	Access Control Error Vulnerability in Spring Security	21 Feb 202400:00	–	cnvd
CVE	CVE-2024-22234	20 Feb 202407:02	–	cve
EUVD	EUVD-2024-0745	3 Oct 202520:07	–	euvd
Github Security Blog	Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated	20 Feb 202409:30	–	github

[
  {
    "defaultStatus": "unaffected",
    "product": "Spring Security",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "6.1.7",
        "status": "affected",
        "version": "6.1.x",
        "versionType": "6.1.7"
      },
      {
        "lessThan": "6.2.2",
        "status": "affected",
        "version": "6.2.x",
        "versionType": "6.2.2"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2024-22234
security	www.security.netapp.com/advisory/ntap-20240315-0003/

15 Mar 2024 11:06Current

7.5High risk

Vulners AI Score7.5

CVSS 3.17.4

EPSS0.00682