PT-2025-22336 · Spring · Spring Security Aspects

🗓️ 19 May 2025 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 4 Views

Spring Security Aspects may cause authorization bypass on private methods in affected applications

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: Maximo AI Service Component: Spring Security Aspects may not correctly locate method security annotations on private methods.	5 Jun 202507:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in spring-security-core-6.4.5.jar	29 Aug 202506:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.1.0	5 Dec 202509:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for December 2025.	12 Jan 202617:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by a vulnerability in spring-security-core-6.4.5.jar (CVE-2025-41232)	24 Oct 202506:51	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring Security, Handlebars, Apache MINA and Apache Tomcat might affect IBM Storage Defender Copy Data Management	26 Jun 202617:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services vulnerable to spring-security-core-6.4.3.jar (CVE-2025-41232)	27 Jun 202506:26	–	ibm
ATTACKERKB	CVE-2025-41232	21 May 202512:16	–	attackerkb
BDU FSTEC	The vulnerability of the configuration @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects in the Java framework for securing Spring-based industrial applications allows attackers to bypass the authentication process.	26 May 202500:00	–	bdu_fstec
Circl	CVE-2025-41232	21 May 202512:26	–	circl

Source	Link
bdu	www.bdu.fstec.ru/vul/2025-05948
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-41232
osv	www.osv.dev/vulnerability/GHSA-9pp5-9c7g-4r83
github	www.github.com/spring-projects/spring-security
twitter	www.twitter.com/CveFindCom/status/1925139339211583883
spring	www.spring.io/security/cve-2025-41232
spring	www.spring.io/security/cve-2025-41232
twitter	www.twitter.com/cracbot/status/1926956525265760545
twitter	www.twitter.com/CVEnew/status/1925140090495578530
twitter	www.twitter.com/CheckmarxZero/status/1925542954057269548

26 May 2025 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 3.19.1

EPSS0.00516

SSVC

spring security authorization bypass private methods method security security annotations