CVE-2019-11272

A flaw was found in Spring Security in several versions, in the use of plain text passwords using the PlaintextPasswordEncoder. If an application is using an affected version of Spring Security with the PlaintextPasswordEncoder and a user has a null encoded password, an attacker can use this flaw...

Spring Security PlaintextPasswordEncoder Unauthorized Access

The vulnerability of the PlaintextPasswordEncoder class implementation in the Spring Security Java framework, which is designed for securing industrial applications, is related to deficiencies in managing registration data. Exploiting this vulnerability could allow an attacker, operating remotely...

spring-security-core: Unauthorized Access with Spring Security Method Security

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted...

Important: Red Hat Security Advisory: Red Hat Fuse 7.4.0 security update

A minor version update from 7.3 to 7.4 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

spring-security-oauth: Privilege escalation by manipulating saved authorization request

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval...

Debian DLA-1848-1 : libspring-security-2.0-java security update

Spring Security support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user or attacker can authenticate using a password of 'null'. For...

[SECURITY] [DLA 1848-1] libspring-security-2.0-java security update

Package : libspring-security-2.0-java Version : 2.0.7.RELEASE-3+deb8u2 CVE ID : CVE-2019-11272 Spring Security support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null...

Security Bulletin: Remote code execution vulnerability (CVE-2019-11269) affects IBM Spectrum Symphony 7.2.1 and 7.2.0.2

Summary A remote code execution vulnerability exists in the Spring Security OAuth version used by IBM Spectrum Symphony 7.2.1 and 7.2.0.2. Interim fixes that provide instructions on upgrading the Spring Security OAuth package to version 2.0.18 which resolves this vulnerability are available on IB...

org.opencastproject:opencast-security-cas (>=7.2, <=18.5) potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.1.7.release)

org.springframework.security:spring-security-cas MAVEN version 3.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - org.opencastproject:opencast-security-cas =7.2, =18.5...

com.github.btheu.settesting:spring (0.1.0), org.pac4j:spring-security-pac4j (>=1.2.3, <=1.2.4) +10 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.2.2.release)

org.springframework.security:spring-security-core MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.btheu.settesting:spring 0.1.0 -...

org.apache.camel:camel-example-spring-security (>=2.14.0, <=2.14.4), org.apache.camel:camel-spring-security (>=2.14.0, <=2.14.4) +27 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.1.7.release)

org.springframework.security:spring-security-core MAVEN version 3.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.apache.camel:camel-example-spring-security =2.14....

co.paralleluniverse:comsat-spring-security (0.3.0), com.bq.corbel:oauth-server (>=1.31.1, <=1.35.0) +289 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.2.5.release)

org.springframework.security:spring-security-core MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - co.paralleluniverse:comsat-spring-security 0.3.0 -...

org.springframework.security:spring-security-acl (2.0.0), org.springframework.security:spring-security-adapters (2.0.0) +18 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (2.0.0)

org.springframework.security:spring-security-core MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.springframework.security:spring-security-acl 2.0.0 -...

org.jasig.cas:cas-server-webapp (>=3.5.0-rc1, <=3.6.0) potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.1.0.release)

org.springframework.security:spring-security-cas MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - org.jasig.cas:cas-server-webapp =3.5.0-rc1, =3.6.0 Sour...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +43 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (2.0.5.release)

org.springframework.security:spring-security-core MAVEN version 2.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.evasion:api =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0....

org.jasig.cas:cas-management-webapp (>=4.0.0-rc4, <=4.0.7) potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.2.0.release)

org.springframework.security:spring-security-cas MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - org.jasig.cas:cas-management-webapp =4.0.0-rc4, =4.0.7...

org.springframework.security:spring-security-acl (2.0.2), org.springframework.security:spring-security-adapters (2.0.2) +18 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (2.0.2)

org.springframework.security:spring-security-core MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.springframework.security:spring-security-acl 2.0.2 -...

com.github.dblock.waffle:waffle-spring-security3 (>=1.5, <=1.6), com.paddypowerbetfair.springframework:spring-security-saml-keys-rollover (1.0.2) +45 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.1.2.release)

org.springframework.security:spring-security-core MAVEN version 3.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.dblock.waffle:waffle-spring-security3 =1.5...

be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3), com.github.yongjacky:jee.borneo.miri (1.1.6) +111 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.1.4.release)

org.springframework.security:spring-security-core MAVEN version 3.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - be.dnsbelgium:rdap-server =0.3.3, =1.6-2, =1.6.0,...

com.vnomicscorp:spring-stateless-ticket-cache-redis (1.0.3), org.eobjects.datacleaner:datacleaner-monitor-completeness-analysis-wizard (>=4.0-rc5, <=4.0.9) +10 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.2.5.release)

org.springframework.security:spring-security-cas MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - com.vnomicscorp:spring-stateless-ticket-cache-redis 1.0...