CVE-2024-22234

In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. Specifically, an application is vulnerable if: The applicatio...

CVE-2023-34042

The spring-security.xsd file inside thespring-security-config jar is world writable which means that if it wereextracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732:Incorrect Permission Assignment for Critical Resou...

CVE-2024-38810

Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.