Security Constraint Bypass in Spring Security

Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +1217 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (>=4.0.0.release, <=4.1.3.release)

org.springframework.security:spring-security-core MAVEN version =4.0.0.release, =0.1.6, =0.1.4-sb1x, =1.3.1-release, =0.1, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =1.0.6.oss, =1.0.6.oss, =1.0.7.oss, =1.0.8.oss and more Source cves: CVE-2016-9879 Source advisory: OSV:GHSA-V35C-49J6-Q8HQ...

org.springframework.security:spring-security-acl (2.0.0), org.springframework.security:spring-security-adapters (2.0.0) +18 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (2.0.0)

org.springframework.security:spring-security-core MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.springframework.security:spring-security-acl 2.0.0 -...

org.springframework.security:spring-security-acl (2.0.2), org.springframework.security:spring-security-adapters (2.0.2) +18 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (2.0.2)

org.springframework.security:spring-security-core MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.springframework.security:spring-security-acl 2.0.2 -...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +43 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (2.0.5.release)

org.springframework.security:spring-security-core MAVEN version 2.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.evasion:api =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0....

com.github.dblock.waffle:waffle-spring-security2 (>=1.5, <=1.6), com.microsoftopentechnologies:azure-slave (>=0.1.0, <=0.3.0) +201 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (2.0.7.release)

org.springframework.security:spring-security-core MAVEN version 2.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.dblock.waffle:waffle-spring-security2 =1.5...

org.appfuse.archetypes:appfuse-basic-jsf (2.0.2), org.appfuse.archetypes:appfuse-basic-spring (2.0.2) +42 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (2.0.1)

org.springframework.security:spring-security-core MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.appfuse.archetypes:appfuse-basic-jsf 2.0.2 -...

org.codehaus.enunciate:enunciate-spring-security-rt (>=1.20, <=1.22), org.codehaus.spring-security-oauth:spring-security-oauth (>=2.4, <=3.19) +20 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (2.0.3)

org.springframework.security:spring-security-core MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.codehaus.enunciate:enunciate-spring-security-rt =1.20,...

com.github.jackpanz:maccloud-core (>=2.4.7, <=2.4.8), com.gwtincubator:gwt-incubator-security (1.0.1) +74 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (2.0.4)

org.springframework.security:spring-security-core MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.jackpanz:maccloud-core =2.4.7, =1.1-1, =1.1-2 -...

com.myjeeva:spring-extensions (>=1.0.0, <=1.0.1), org.springframework.security:spring-security-acl (2.0.6.release) +6 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (2.0.6.release)

org.springframework.security:spring-security-core MAVEN version 2.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.myjeeva:spring-extensions =1.0.0, =1.0.1 -...

com.github.dblock.waffle:waffle-spring-security2 (>=1.7, <=1.7.5), com.googlecode.cedar-common:cedar-common-gae (>=2.1.3, <=5.8.4) +12 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (2.0.8.release)

org.springframework.security:spring-security-core MAVEN version 2.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.dblock.waffle:waffle-spring-security2 =1.7...

at.molindo.social:spring-social-security (>=1.1.0.release, <=1.1.4.release), be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3) +1135 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.2.9.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.1.0.release, =0.3.3, =1.2.1, =2.0.0, =0.0.2, =3.0.0, =3.0.0, =3.0.0, =1.0.0, =1.1.4 and more Source cves: CVE-2016-9879 Source advisory: OSV:GHSA-V35C-49J6-Q8HQ...

at.molindo.social:spring-social-security (>=1.1.0.release, <=1.1.4.release), be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3) +1135 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.2.9.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.1.0.release, =0.3.3, =1.2.1, =2.0.0, =0.0.2, =3.0.0, =3.0.0, =3.0.0, =1.0.0, =1.1.4 and more Source cves: CVE-2016-9879 Source advisory: GHSA-V35C-49J6-Q8HQ...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +1217 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (>=4.0.0.release, <=4.1.3.release)

org.springframework.security:spring-security-core MAVEN version =4.0.0.release, =0.1.6, =0.1.4-sb1x, =1.3.1-release, =0.1, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =1.0.6.oss, =1.0.6.oss, =1.0.7.oss, =1.0.8.oss and more Source cves: CVE-2016-9879 Source advisory: GHSA-V35C-49J6-Q8HQ...

com.ahome-it:ahome-tooling-server-core (>=1.1.19-release, <=1.1.27-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.23-release, <=1.1.27-release) +99 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (4.2.0.release)

org.springframework.security:spring-security-core MAVEN version 4.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.19-releas...

com.ahome-it:ahome-tooling-server-core (>=1.1.19-release, <=1.1.27-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.23-release, <=1.1.27-release) +99 more potentially affected by CVE-2016-9879 via org.springframework.security:spring-security-core (4.2.0.release)

org.springframework.security:spring-security-core MAVEN version 4.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.19-releas...

Authorization Bypass in Spring Security

When using Spring Security's CAS Proxy ticket authentication a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is...

GHSA-WMV4-5W76-VP9G Authorization Bypass in Spring Security

When using Spring Security's CAS Proxy ticket authentication a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is...

org.springframework.security:spring-security-acl (2.0.0), org.springframework.security:spring-security-adapters (2.0.0) +18 more potentially affected by CVE-2014-3527 via org.springframework.security:spring-security-core (2.0.0)

org.springframework.security:spring-security-core MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.springframework.security:spring-security-acl 2.0.0 -...

org.springframework.security:spring-security-acl (2.0.2), org.springframework.security:spring-security-adapters (2.0.2) +18 more potentially affected by CVE-2014-3527 via org.springframework.security:spring-security-core (2.0.2)

org.springframework.security:spring-security-core MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.springframework.security:spring-security-acl 2.0.2 -...