CVEvulnerability
CVE-2024-22257
8.2 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2024-03-18
- Last modified
- 2026-06-30
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Weaknesses
- CWE-862
Description
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to
5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8,
versions 6.2.x prior to 6.2.3, an application is possible vulnerable to
broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://security.netapp.com/advisory/ntap-20240419-0005/ security.netapp.com
- https://spring.io/security/cve-2024-22257 spring.io
- https://github.com/dependency-check/DependencyCheck/issues/8642 github.com
- https://security.netapp.com/advisory/ntap-20240419-0005/ security.netapp.com
- https://spring.io/security/cve-2024-22257 spring.io