Security Constraint Bypass

2018-01-3103:11:32

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

JSON

spring-security-web and spring-web are vulnerable to security bypass with static resources. Spring uses the output of getPathInfo() when mapping security constraints and requests. It is not standardized whether the path parameters should be included in the value from getPathInfo(). Using this knowledge, attackers can bypass security constraints by using encoded characters.

CPENameOperatorVersion
spring-security-webeq5.0.0.RELEASE
spring-security-weble4.1.4.RELEASE
spring-security-weble4.0.4.RELEASE
spring-security-weble4.2.3.RELEASE
spring web mvcle4.3.12.RELEASE
spring web mvcle5.0.1.RELEASE
spring-security-webeq5.0.0.RELEASE
spring-security-weble4.1.4.RELEASE
spring-security-weble4.0.4.RELEASE
spring-security-weble4.2.3.RELEASE

Name	Operator	Version
spring-security-web	eq	5.0.0.RELEASE
spring-security-web	le	4.1.4.RELEASE
spring-security-web	le	4.0.4.RELEASE
spring-security-web	le	4.2.3.RELEASE
spring web mvc	le	4.3.12.RELEASE
spring web mvc	le	5.0.1.RELEASE
spring-security-web	eq	5.0.0.RELEASE
spring-security-web	le	4.1.4.RELEASE
spring-security-web	le	4.0.4.RELEASE
spring-security-web	le	4.2.3.RELEASE