CVEvulnerability

CVE-2026-40997

5.3 MEDIUM Published 2026-06-11 Modified 2026-09-04 Official page ↗
Status
Undergoing Analysis
Published
2026-06-11
Last modified
2026-09-04
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-209

Description

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Affected configurations

• broadcom spring web services (< 3.1.9) • broadcom spring web services (>= 4.0.0 < 4.0.19) • broadcom spring web services (>= 4.1.0 < 4.1.3.1) • broadcom spring web services (>= 5.0.0 < 5.0.1.1)

Related

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References