Improper Password Verification

🗓️ 28 Mar 2025 06:37:51Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 5 Views

Vulnerability in Spring Security due to improper password verification from truncation in BCrypt.

Reporter	Title	Published	Views	Family All 98
IBM Security Bulletins	Security Bulletin: Vulnerabilities in old Spring Framework versions affect watsonx.data	13 Jun 202510:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.0.2	21 Jun 202513:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Broker Component vulnerable to BCryptPasswordEncoder will incorrectly return true for passwords larger than 72 characters.	28 Mar 202520:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability with spring-security-crypto and jinja affect IBM Cloud Object Storage Systems (July 2025)	1 Aug 202516:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions.	30 Jun 202523:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.10	29 Jul 202522:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in dependencies affect IBM Common Licensing	3 Sep 202504:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in Spring boot and Spring Security	24 Oct 202506:57	–	ibm
ATTACKERKB	CVE-2025-22228	20 Mar 202506:15	–	attackerkb
ATTACKERKB	CVE-2025-22234	22 Jan 202621:02	–	attackerkb

Vulners

Node

springframework spring-security-cryptoRange3.1.0.RC1–5.7.14java

springframework spring-security-cryptoRange5.8.0-M1–5.8.17java

springframework spring-security-cryptoRange6.0.0-M1–6.0.15java

springframework spring-security-cryptoRange6.1.0-M1–6.1.13java

springframework spring-security-cryptoRange6.2.0-M1–6.2.9java

springframework spring-security-cryptoRange6.3.0-M1–6.3.7java

springframework spring-security-cryptoRange6.4.0-M1–6.4.3java

springframework spring-security-cryptoMatch6.3.0java

springframework spring-security-cryptoMatch6.3.1java

springframework spring-security-cryptoMatch6.3.2java

springframework spring-security-cryptoMatch6.3.3java

springframework spring-security-cryptoMatch6.3.4java

springframework spring-security-cryptoMatch6.3.5java

springframework spring-security-cryptoMatch6.3.6java

springframework spring-security-cryptoMatch6.4.0java

springframework spring-security-cryptoMatch6.4.1java

springframework spring-security-cryptoMatch6.4.2java

springframework spring-security-cryptoMatch6.2.0java

springframework spring-security-cryptoMatch6.2.1java

springframework spring-security-cryptoMatch6.2.2java

springframework spring-security-cryptoMatch6.2.3java

springframework spring-security-cryptoMatch6.2.4java

springframework spring-security-cryptoMatch6.2.5java

springframework spring-security-cryptoMatch6.2.6java

springframework spring-security-cryptoMatch6.2.7java

springframework spring-security-cryptoMatch6.2.8java

springframework spring-security-cryptoMatch6.1.0java

springframework spring-security-cryptoMatch6.1.1java

springframework spring-security-cryptoMatch6.1.2java

springframework spring-security-cryptoMatch6.1.3java

springframework spring-security-cryptoMatch6.1.4java

springframework spring-security-cryptoMatch6.1.5java

springframework spring-security-cryptoMatch6.1.6java

springframework spring-security-cryptoMatch6.1.7java

springframework spring-security-cryptoMatch6.1.8java

springframework spring-security-cryptoMatch6.1.9java

springframework spring-security-cryptoMatch6.0.0java

springframework spring-security-cryptoMatch6.0.1java

springframework spring-security-cryptoMatch6.0.2java

springframework spring-security-cryptoMatch6.0.3java

springframework spring-security-cryptoMatch6.0.4java

springframework spring-security-cryptoMatch6.0.5java

springframework spring-security-cryptoMatch6.0.6java

springframework spring-security-cryptoMatch6.0.7java

springframework spring-security-cryptoMatch6.0.8java

springframework spring-security-cryptoMatch5.8.0java

springframework spring-security-cryptoMatch5.8.1java

springframework spring-security-cryptoMatch5.8.10java

springframework spring-security-cryptoMatch5.8.11java

springframework spring-security-cryptoMatch5.8.12java

springframework spring-security-cryptoMatch5.8.13java

springframework spring-security-cryptoMatch5.8.14java

springframework spring-security-cryptoMatch5.8.15java

springframework spring-security-cryptoMatch5.8.16java

springframework spring-security-cryptoMatch5.8.2java

springframework spring-security-cryptoMatch5.8.3java

springframework spring-security-cryptoMatch5.8.4java

springframework spring-security-cryptoMatch5.8.5java

springframework spring-security-cryptoMatch5.8.6java

springframework spring-security-cryptoMatch5.8.7java

springframework spring-security-cryptoMatch5.8.8java

springframework spring-security-cryptoMatch5.8.9java

springframework spring-security-cryptoMatch3.1.0.releasejava

springframework spring-security-cryptoMatch3.1.1.releasejava

springframework spring-security-cryptoMatch3.1.2.releasejava

springframework spring-security-cryptoMatch3.1.3.releasejava

springframework spring-security-cryptoMatch3.1.4.releasejava

springframework spring-security-cryptoMatch3.1.5.releasejava

springframework spring-security-cryptoMatch3.1.6.releasejava

springframework spring-security-cryptoMatch3.1.7.releasejava

springframework spring-security-cryptoMatch3.2.0.releasejava

springframework spring-security-cryptoMatch3.2.1.releasejava

springframework spring-security-cryptoMatch3.2.10.releasejava

springframework spring-security-cryptoMatch3.2.2.releasejava

springframework spring-security-cryptoMatch3.2.3.releasejava

springframework spring-security-cryptoMatch3.2.4.releasejava

springframework spring-security-cryptoMatch3.2.5.releasejava

springframework spring-security-cryptoMatch3.2.6.releasejava

springframework spring-security-cryptoMatch3.2.7.releasejava

springframework spring-security-cryptoMatch3.2.8.releasejava

springframework spring-security-cryptoMatch3.2.9.releasejava

springframework spring-security-cryptoMatch4.0.0.releasejava

springframework spring-security-cryptoMatch4.0.1.releasejava

springframework spring-security-cryptoMatch4.0.2.releasejava

springframework spring-security-cryptoMatch4.0.3.releasejava

springframework spring-security-cryptoMatch4.0.4.releasejava

springframework spring-security-cryptoMatch4.1.0.releasejava

springframework spring-security-cryptoMatch4.1.1.releasejava

springframework spring-security-cryptoMatch4.1.2.releasejava

springframework spring-security-cryptoMatch4.1.3.releasejava

springframework spring-security-cryptoMatch4.1.4.releasejava

springframework spring-security-cryptoMatch4.1.5.releasejava

springframework spring-security-cryptoMatch4.2.0.releasejava

springframework spring-security-cryptoMatch4.2.1.releasejava

springframework spring-security-cryptoMatch4.2.10.releasejava

springframework spring-security-cryptoMatch4.2.11.releasejava

springframework spring-security-cryptoMatch4.2.12.releasejava

springframework spring-security-cryptoMatch4.2.13.releasejava

springframework spring-security-cryptoMatch4.2.14.releasejava

springframework spring-security-cryptoMatch4.2.15.releasejava

springframework spring-security-cryptoMatch4.2.16.releasejava

springframework spring-security-cryptoMatch4.2.17.releasejava

springframework spring-security-cryptoMatch4.2.18.releasejava

springframework spring-security-cryptoMatch4.2.19.releasejava

springframework spring-security-cryptoMatch4.2.2.releasejava

springframework spring-security-cryptoMatch4.2.20.releasejava

springframework spring-security-cryptoMatch4.2.3.releasejava

springframework spring-security-cryptoMatch4.2.4.releasejava

springframework spring-security-cryptoMatch4.2.5.releasejava

springframework spring-security-cryptoMatch4.2.6.releasejava

springframework spring-security-cryptoMatch4.2.7.releasejava

springframework spring-security-cryptoMatch4.2.8.releasejava

springframework spring-security-cryptoMatch4.2.9.releasejava

springframework spring-security-cryptoMatch5.0.0.releasejava

springframework spring-security-cryptoMatch5.0.1.releasejava

springframework spring-security-cryptoMatch5.0.10.releasejava

springframework spring-security-cryptoMatch5.0.11.releasejava

springframework spring-security-cryptoMatch5.0.12.releasejava

springframework spring-security-cryptoMatch5.0.13.releasejava

springframework spring-security-cryptoMatch5.0.14.releasejava

springframework spring-security-cryptoMatch5.0.15.releasejava

springframework spring-security-cryptoMatch5.0.16.releasejava

springframework spring-security-cryptoMatch5.0.17.releasejava

springframework spring-security-cryptoMatch5.0.18.releasejava

springframework spring-security-cryptoMatch5.0.19.releasejava

springframework spring-security-cryptoMatch5.0.2.releasejava

springframework spring-security-cryptoMatch5.0.3.releasejava

springframework spring-security-cryptoMatch5.0.4.releasejava

springframework spring-security-cryptoMatch5.0.5.releasejava

springframework spring-security-cryptoMatch5.0.6.releasejava

springframework spring-security-cryptoMatch5.0.7.releasejava

springframework spring-security-cryptoMatch5.0.8.releasejava

springframework spring-security-cryptoMatch5.0.9.releasejava

springframework spring-security-cryptoMatch5.1.0.releasejava

springframework spring-security-cryptoMatch5.1.1.releasejava

springframework spring-security-cryptoMatch5.1.10.releasejava

springframework spring-security-cryptoMatch5.1.11.releasejava

springframework spring-security-cryptoMatch5.1.12.releasejava

springframework spring-security-cryptoMatch5.1.13.releasejava

springframework spring-security-cryptoMatch5.1.2.releasejava

springframework spring-security-cryptoMatch5.1.3.releasejava

springframework spring-security-cryptoMatch5.1.4.releasejava

springframework spring-security-cryptoMatch5.1.5.releasejava

springframework spring-security-cryptoMatch5.1.6.releasejava

springframework spring-security-cryptoMatch5.1.7.releasejava

springframework spring-security-cryptoMatch5.1.8.releasejava

springframework spring-security-cryptoMatch5.1.9.releasejava

springframework spring-security-cryptoMatch5.2.0.releasejava

springframework spring-security-cryptoMatch5.2.1.releasejava

springframework spring-security-cryptoMatch5.2.10.releasejava

springframework spring-security-cryptoMatch5.2.11.releasejava

springframework spring-security-cryptoMatch5.2.12.releasejava

springframework spring-security-cryptoMatch5.2.13.releasejava

springframework spring-security-cryptoMatch5.2.14.releasejava

springframework spring-security-cryptoMatch5.2.15.releasejava

springframework spring-security-cryptoMatch5.2.2.releasejava

springframework spring-security-cryptoMatch5.2.3.releasejava

springframework spring-security-cryptoMatch5.2.4.releasejava

springframework spring-security-cryptoMatch5.2.5.releasejava

springframework spring-security-cryptoMatch5.2.6.releasejava

springframework spring-security-cryptoMatch5.2.7.releasejava

springframework spring-security-cryptoMatch5.2.8.releasejava

springframework spring-security-cryptoMatch5.2.9.releasejava

springframework spring-security-cryptoMatch5.3.0.releasejava

springframework spring-security-cryptoMatch5.3.1.releasejava

springframework spring-security-cryptoMatch5.3.10.releasejava

springframework spring-security-cryptoMatch5.3.11.releasejava

springframework spring-security-cryptoMatch5.3.12.releasejava

springframework spring-security-cryptoMatch5.3.13.releasejava

springframework spring-security-cryptoMatch5.3.2.releasejava

springframework spring-security-cryptoMatch5.3.3.releasejava

springframework spring-security-cryptoMatch5.3.4.releasejava

springframework spring-security-cryptoMatch5.3.5.releasejava

springframework spring-security-cryptoMatch5.3.6.releasejava

springframework spring-security-cryptoMatch5.3.7.releasejava

springframework spring-security-cryptoMatch5.3.8.releasejava

springframework spring-security-cryptoMatch5.3.9.releasejava

springframework spring-security-cryptoMatch5.4.0java

springframework spring-security-cryptoMatch5.4.1java

springframework spring-security-cryptoMatch5.4.10java

springframework spring-security-cryptoMatch5.4.11java

springframework spring-security-cryptoMatch5.4.2java

springframework spring-security-cryptoMatch5.4.3java

springframework spring-security-cryptoMatch5.4.4java

springframework spring-security-cryptoMatch5.4.5java

springframework spring-security-cryptoMatch5.4.6java

springframework spring-security-cryptoMatch5.4.7java

springframework spring-security-cryptoMatch5.4.8java

springframework spring-security-cryptoMatch5.4.9java

springframework spring-security-cryptoMatch5.5.0java

springframework spring-security-cryptoMatch5.5.1java

springframework spring-security-cryptoMatch5.5.2java

springframework spring-security-cryptoMatch5.5.3java

springframework spring-security-cryptoMatch5.5.4java

springframework spring-security-cryptoMatch5.5.5java

springframework spring-security-cryptoMatch5.5.6java

springframework spring-security-cryptoMatch5.5.7java

springframework spring-security-cryptoMatch5.5.8java

springframework spring-security-cryptoMatch5.6.0java

springframework spring-security-cryptoMatch5.6.1java

springframework spring-security-cryptoMatch5.6.10java

springframework spring-security-cryptoMatch5.6.11java

springframework spring-security-cryptoMatch5.6.12java

springframework spring-security-cryptoMatch5.6.2java

springframework spring-security-cryptoMatch5.6.3java

springframework spring-security-cryptoMatch5.6.4java

springframework spring-security-cryptoMatch5.6.5java

springframework spring-security-cryptoMatch5.6.6java

springframework spring-security-cryptoMatch5.6.7java

springframework spring-security-cryptoMatch5.6.8java

springframework spring-security-cryptoMatch5.6.9java

springframework spring-security-cryptoMatch5.7.0java

springframework spring-security-cryptoMatch5.7.1java

springframework spring-security-cryptoMatch5.7.10java

springframework spring-security-cryptoMatch5.7.11java

springframework spring-security-cryptoMatch5.7.12java

springframework spring-security-cryptoMatch5.7.13java

springframework spring-security-cryptoMatch5.7.2java

springframework spring-security-cryptoMatch5.7.3java

springframework spring-security-cryptoMatch5.7.4java

springframework spring-security-cryptoMatch5.7.5java

springframework spring-security-cryptoMatch5.7.6java

springframework spring-security-cryptoMatch5.7.7java

springframework spring-security-cryptoMatch5.7.8java

springframework spring-security-cryptoMatch5.7.9java

Source	Link
security	www.security.netapp.com/advisory/ntap-20250425-0009
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-22228
spring	www.spring.io/security/cve-2025-22228
github	www.github.com/spring-projects/spring-security/commit/46f0dc6dfc8402cd556c598fdf2d31f9d46cdbf3
github	www.github.com/spring-projects/spring-security

13 Dec 2025 04:59Current

7.2High risk

Vulners AI Score7.2

CVSS 3.17.4

EPSS0.00065

SSVC