com.cedac.spring.security:spring-security-mongodb (1.0.0), com.foreach.across.modules:admin-web-module (>=1.0.0.release, <=1.1.0.release) +127 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (3.2.7.release)

org.springframework.security:spring-security-core MAVEN version 3.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.cedac.spring.security:spring-security-mongodb 1.0...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +328 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (4.2.5.release)

org.springframework.security:spring-security-core MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1,...

com.auth0:auth0-spring-security-api (>=1.4.1, <=1.5.3), com.dahuatech.harriet.icc:eco-brm-client (>=1.0.1, <=1.0.1.4) +123 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (4.2.20.release)

org.springframework.security:spring-security-core MAVEN version 4.2.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.auth0:auth0-spring-security-api =1.4.1, =1.0.1,...

com.capitalone.dashboard:core (>=3.7.8, <=3.9.9), com.github.waffle.demo:waffle-spring-filter (2.3.0) +56 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (4.2.17.release)

org.springframework.security:spring-security-core MAVEN version 4.2.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.capitalone.dashboard:core =3.7.8, =1.7-15, =1.7-...

Erroneous authentication pass in Spring Security

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVotervote passing a null...

cc.kebei:onion-expands-office (>=3.0.3, <=3.0.6), cc.kebei:onion-expands-script (>=3.0.3, <=3.0.6) +121 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (4.2.12.release)

org.springframework.security:spring-security-core MAVEN version 4.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - cc.kebei:onion-expands-office =3.0.3, =3.0.3, =3.0.3...

be.dnsbelgium:rdap-server (1.1.0), co.paralleluniverse:comsat-spring-boot-security (0.4.0) +98 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (4.0.1.release)

org.springframework.security:spring-security-core MAVEN version 4.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - be.dnsbelgium:rdap-server 1.1.0 -...

org.springframework.security:spring-security-acl (2.0.2), org.springframework.security:spring-security-adapters (2.0.2) +18 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (2.0.2)

org.springframework.security:spring-security-core MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.springframework.security:spring-security-acl 2.0.2 -...

com.capitalone.dashboard:api (>=3.3.0, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.5.1, <=3.7.33) +81 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (4.2.18.release)

org.springframework.security:spring-security-core MAVEN version 4.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.capitalone.dashboard:api =3.3.0, =3.5.1, =3.2.0,...

com.antheminc.oss:nimbus-core (>=1.1.7, <=1.2.0), com.antheminc.oss:nimbus-entity-dsl (>=1.1.7, <=1.2.0) +359 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (4.2.6.release)

org.springframework.security:spring-security-core MAVEN version 4.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.antheminc.oss:nimbus-core =1.1.7, =1.1.7, =1.1.7,...

be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3), com.github.yongjacky:jee.borneo.miri (1.1.6) +111 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (3.1.4.release)

org.springframework.security:spring-security-core MAVEN version 3.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - be.dnsbelgium:rdap-server =0.3.3, =1.6-2, =1.6.0,...

CVE-2024-22257

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVotervote passing a null...

CVE-2024-22257

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVotervote passing a null...

CVE-2024-22257

CVE-2024-22257 refers to a broken access control in Spring Security where an application vulnerable if it directly uses AuthenticatedVoter.vote with a null Authentication. The entry lists affected versions: 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, 6.0.x prior to 6.0.9, 6.1.x prior to 6.1.8, ...

CVE-2024-22257

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVotervote passing a null...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +9688 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (>=2.0.0, <=5.7.11)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.0, =0.1.8, =0.1.6, =0.1.7 and more Source cves: CVE-2024-22257 Source advisory: MEND:CVE-2024-22257...

CVE-2024-22257

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVotervote passing a null...

cn.sparrowmini:sparrow-org-service (0.0.1), cn.sparrowmini:sparrow-pem-service (0.0.1) +618 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (>=5.8.0, <=5.8.10)

org.springframework.security:spring-security-core MAVEN version =5.8.0, =5.2.0, =5.11.0, =5.11.0, =1.48.0, =1.48.0, =1.48.0, =2.4.0, =2.4.0, =2.4.0, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =4.1.4 and more Source cves: CVE-2024-22257 Source advisory: MEND:CVE-2024-22257...

app.valuationcontrol:library (>=0.5.2, <=0.5.6), app.valuationcontrol:webservice (>=0.5.0, <=0.5.1) +1446 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (>=6.2.0, <=6.2.2)

org.springframework.security:spring-security-core MAVEN version =6.2.0, =0.5.2, =0.5.0, =7.0.0, =1.0.0, =v1.0.26, =v1.0.26, =v1.0.26, =v1.0.26, =v1.0.26, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.2.2 and more Source cves: CVE-2024-22257 Source advisory: MEND:CVE-2024-22257...

be.jidoka:jdk-keycloak-admin (>=2.0.0, <=2.2.0), be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.2.release) +1829 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (>=6.0.0, <=6.1.7)

org.springframework.security:spring-security-core MAVEN version =6.0.0, =2.0.0, =1.5.1.release, =1.1.0, =1.1.0, =1.1.4.2, =1.1.5 - cc.vihackerframework:vihacker-auth-starter 1.0.8.r - cc.vihackerframework:vihacker-common-starter 1.0.8.r - cc.vihackerframework:vihacker-log-starter 1.0.8.r -...