spring-security: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated

🗓️ 25 Jul 2024 19:26:07Reported by RedHatType

Spring Security bug causes broken access control by calling isFullyAuthenticated with a null Authentication, risking confidentiality and integrity.

Reporter	Title	Published	Views	Family All 31
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 1.14.4 IF001	14 May 202420:42	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	10 Apr 202409:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.7.5 addresses multiple security vulnerabilities.	3 Feb 202523:04	–	ibm
BDU FSTEC	The vulnerability of the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method in the Java framework for securing industrial applications by Spring Security allows attackers to influence the integrity and confidentiality of protected information.	27 Feb 202400:00	–	bdu_fstec
Circl	CVE-2024-22234	20 Feb 202408:22	–	circl
CNNVD	VMware Spring Security 安全漏洞	20 Feb 202400:00	–	cnnvd
CNVD	Access Control Error Vulnerability in Spring Security	21 Feb 202400:00	–	cnvd
CVE	CVE-2024-22234	20 Feb 202407:02	–	cve
Cvelist	CVE-2024-22234 CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated	20 Feb 202407:02	–	cvelist
EUVD	EUVD-2024-0745	3 Oct 202520:07	–	euvd

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2024-22234
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-22234
spring	www.spring.io/security/cve-2024-22234
cve	www.cve.org/CVERecord

05 Jul 2026 14:34Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.4

EPSS0.00682

SSVC