PT-2018-11345 · Spring · Spring Framework

Name of the Vulnerable Software and Affected Versions: Spring Framework versions 5.0 prior to 5.0.5 Spring Framework versions 4.3 prior to 4.3.15 Spring Framework older unsupported versions Description: The issue allows applications to configure Spring MVC to serve static resources. A malicious...

PT-2018-2614

Name of the Vulnerable Software and Affected Versions Spring Framework versions 4.3 prior to 4.3.15 and versions 5.0 prior to 5.0.5 Description The issue is caused by errors in handling STOMP messages in the spring-messaging module of the Spring Framework. A malicious user can craft a message to...

Remote Code Execution with spring-messaging

Spring Framework, versions 5.0.x prior to 5.0.5 and versions 4.3.x prior to 4.3.16, and older unsupported versions allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a messag...

Security feature bypass

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

UBUNTU-CVE-2018-1199

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

CVE-2018-1199

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

CVE-2018-1199

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

DEBIAN-CVE-2018-1199

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

CVE-2018-1199

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

CVE-2018-1199

CVE-2018-1199 affects Spring Security (4.1.x before 4.1.5, 4.2.x before 4.2.4, 5.0.x before 5.0.1) and Spring Framework (4.3.x before 4.3.14, 5.0.x before 5.0.3). The issue is that URL path parameters are not consistently handled when evaluating security constraints, allowing an attacker to bypas...

PT-2018-10937

Name of the Vulnerable Software and Affected Versions Spring Security versions 4.1.x through 4.1.4 Spring Security versions 4.2.x through 4.2.3 Spring Security versions 5.0.x through 5.0.0 Spring Framework versions 4.3.x through 4.3.13 Spring Framework versions 5.0.x through 5.0.2 Description The...

CVE-2018-1199: Improper Input Validation

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

Spring Security and Spring Framework Authentication Bypass Vulnerability

Spring Security is a set of Spring-based applications to provide illustrative security protection of the security framework.Spring Framework is the United States Pivotal Corporation's set of open source Java, Java EE application framework. Spring Security and Spring Framework authentication bypas...

Spring Security and Spring Framework vulnerable to authentication bypass

Overview Spring Framework and Spring Security provided by Pivotal Software, Inc. contain an authentication bypass vulnerability. Macchinetta Framework Development Team : NTT COMWARE, NTT DATA Corporation, and NTT reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

JVN#15643848: Spring Security and Spring Framework vulnerable to authentication bypass

Spring Framework and Spring Security provided by Pivotal Software, Inc. contain an authentication bypass vulnerability. Impact A remote attacker can bypass authentication. As a result, the attacker gains access to the server and information may be disclosed. Solution Update the Software Update to...

Framework: Directory Traversal in the Spring Framework ResourceServlet

It was found that ResourceServlet in Spring Framework does not sanitize the paths that have been provided properly. An attacker can utilize this flaw to conduct a directory traversal attacks...

Pivotal Spring-LDAP Authentication Bypass Vulnerability

Pivotal Spring-LDAP is the U.S. Pivotal Software, Inc. to simplify LDAP programming in Java in a library . An authentication bypass vulnerability exists in Pivotal Spring-LDAP versions 1.3.0 through 2.3.1. A remote attacker can exploit this vulnerability to bypass the authentication mechanism and...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in springframework-social before 1.1.3...

The vulnerability of the org.springframework.core.serializer.DefaultDeserializer component in the Spring AMQP RabbitMQ messaging application, which allows an attacker to execute arbitrary code.

The vulnerability of the org.springframework.core.serializer.DefaultDeserializer component in the Spring AMQP RabbitMQ messaging application exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code...

UBUNTU-CVE-2014-0225

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack...