CVEvulnerability

CVE-2019-11272

7.3 HIGH Published 2019-06-26 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2019-06-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-287, CWE-522

Description

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".

Affected configurations

• vmware spring security (< 4.2.13) • debian debian linux 8.0

Related

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References