Information Disclosure

🗓️ 15 May 2020 01:01:34Reported by Veracode Vulnerability DatabaseType

spring-security-core vulnerable to Information Disclosure due to fixed null IV in CBC mode encrypto

Reporter	Title	Published	Views	Family All 29
IBM Security Bulletins	Security Bulletin: IBM Cognos Controller has addressed multiple vulnerabilities	2 Dec 202219:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities	7 Oct 202022:53	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in jQuery, Spring, Dom4j, MongoDB, Linux Kernel, Targetcli-fb, Jackson, Node.js, and Apache Commons affect IBM Spectrum Protect Plus	20 Nov 202020:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling B2B Integrator vulnerable to multiple vulnerabilities due to Spring Security	13 May 202214:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Service is vulnerable to multiple vulnerabilities due to IBM Java	10 May 202404:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	2 Feb 202105:06	–	ibm
CNVD	Spring Security Security Feature Issue Vulnerability	15 May 202000:00	–	cnvd
CVE	CVE-2020-5408	14 May 202017:15	–	cve
Cvelist	CVE-2020-5408 Dictionary attack with Spring Security queryable text encryptor	14 May 202017:15	–	cvelist
EUVD	EUVD-2020-0449	7 Oct 202500:30	–	euvd

Vulners

Node

springframework spring-security-coreRange3.1.0.RELEASE–4.2.15.RELEASEjava

springframework spring-security-coreRange5.0.0.RELEASE–5.0.15.RELEASEjava

springframework spring-security-coreRange5.1.0.RELEASE–5.1.9.RELEASEjava

springframework spring-security-coreRange5.2.0.RELEASE–5.2.3.RELEASEjava

springframework spring-security-coreRange5.3.0.RELEASE–5.3.1.RELEASEjava

springframework spring-security-cryptoRange3.1.0.RELEASE–4.2.15.RELEASEjava

springframework spring-security-cryptoRange5.0.0.RELEASE–5.0.15.RELEASEjava

springframework spring-security-cryptoRange5.1.0.RELEASE–5.1.9.RELEASEjava

springframework spring-security-cryptoRange5.2.0.RELEASE–5.2.3.RELEASEjava

springframework spring-security-cryptoRange5.3.0.RELEASE–5.3.1.RELEASEjava

Source	Link
github	www.github.com/spring-projects/spring-security/issues/8317
oracle	www.oracle.com/security-alerts/cpuApr2021.html
oracle	www.oracle.com/security-alerts/cpujan2021.html
oracle	www.oracle.com/security-alerts/cpuoct2020.html
tanzu	www.tanzu.vmware.com/security/cve-2020-5408

14 Jun 2021 21:27Current

1.8Low risk

Vulners AI Score1.8

CVSS 24

CVSS 3.16.5

EPSS0.00411