CVE-2018-1199

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4,
and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x
before 5.0.3) does not consider URL path parameters when processing
security constraints. By adding a URL path parameter with special
encodings, an attacker may be able to bypass a security constraint. The
root cause of this issue is a lack of clarity regarding the handling of
path parameters in the Servlet Specification. Some Servlet containers
include path parameters in the value returned for getPathInfo() and some do
not. Spring Security uses the value returned by getPathInfo() as part of
the process of mapping requests to security constraints. In this particular
attack, different character encodings used in path parameters allows
secured Spring MVC static resource URLs to be bypassed.