Authorization Bypass

🗓️ 30 Oct 2024 03:57:15Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 18 Views

Spring Security's flaw in authorization rules for WebFlux allows bypassing for static resources.

Reporter	Title	Published	Views	Family All 45
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for February 2025.	12 Mar 202511:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager	16 Dec 202507:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities that affects BigReplicate (CVE-2024-51504, CVE-2024-38821, CVE-2023-20863)	26 Aug 202520:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in spring-security-web-5.8.5.jar	8 Jul 202506:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for Nov 2024	26 Nov 202409:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for Jan 2025 - Multiple CVEs addressed	14 Feb 202505:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - AI Broker Component uses spring-security-web-6.3.3.jar which is vulnerable to this CVE-2024-38821	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring WebFlux, Jenkins, Spring Securiy, Spring Framework, and Node.js lodash might affect IBM Storage Defender Copy Data Management.	5 May 202618:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager	16 Dec 202505:55	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring WebFlux affects watsonx.data	27 Feb 202513:26	–	ibm

Vulners

Node

springframework spring-security-webRange5.0.0.M1–5.7.12java

springframework spring-security-webRange5.8.0-M1–5.8.14java

springframework spring-security-webRange6.2.0-M1–6.2.6java

springframework spring-security-webRange6.0.0-M1–6.0.8java

springframework spring-security-webRange6.1.0-M1–6.1.9java

springframework spring-security-webRange6.3.0-M1–6.3.3java

Source	Link
github	www.github.com/spring-projects/spring-security/commit/0e257b56ce35402558a260ffa6b368982f9a7934
github	www.github.com/spring-projects/spring-security/commit/4ce7cde15599c0447163fd46bac616e03318bf5b
github	www.github.com/advisories/GHSA-c4q5-6c82-3qpw
security	www.security.netapp.com/advisory/ntap-20250124-0006/
spring	www.spring.io/security/cve-2024-38821

24 Jan 2025 21:17Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.19.1

EPSS0.1309

SSVC