Spring Security and Spring Framework vulnerable to authentication bypass

🗓️ 02 Feb 2018 03:28:18Reported by Japan Vulnerability NotesType

Spring Framework and Spring Security have an authentication bypass vulnerability; update to the latest version.

Reporter	Title	Published	Views	Family All 30
IBM Security Bulletins	Security Bulletin: IBM Cognos Controller has addressed multiple vulnerabilities	2 Dec 202219:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)	12 Jan 202114:42	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring Core affect watsonx.data	10 Feb 202510:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities fixed in 9.7.2.7	24 Oct 202411:46	–	ibm
CNVD	Spring Security and Spring Framework Authentication Bypass Vulnerability	5 Feb 201800:00	–	cnvd
CVE	CVE-2018-1199	16 Mar 201820:00	–	cve
Cvelist	CVE-2018-1199	16 Mar 201820:00	–	cvelist
Debian CVE	CVE-2018-1199	16 Mar 201820:00	–	debiancve
EUVD	EUVD-2018-0691	7 Oct 202500:30	–	euvd
Github Security Blog	Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core	17 Oct 201820:01	–	github

Source	Link
fujitsu	www.fujitsu.com/jp/products/software/resources/condition/security/products-fujitsu/solution/interstage-bas-201801.html
jpn	www.jpn.nec.com/security-info/secinfo/nv18-004.html
pivotal	www.pivotal.io/security/cve-2018-1199
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
jvn	www.jvn.jp/en/jp/JVN15643848/index.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-1199
ipa	www.ipa.go.jp/en/security/vulnerabilities/cwe.html

14 Jun 2018 04:48Current

6.9Medium risk

Vulners AI Score6.9

CVSS 25

CVSS 35.3

CVSS 3.15.3

EPSS0.02857