GitHub Advisoryadvisory · Maven

GHSA-v33x-prhc-gph5 Insufficiently Protected Credentials and Improper Authentication in Spring Security

HIGH Published 2019-06-27 Modified 2021-06-09 Official page ↗
Aliases
CVE-2019-11272
Ecosystem
Maven
Packages
org.springframework.security:spring-security-core, org.springframework.security:spring-security-cas
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-287, CWE-522
Reviewed
2019-06-27

Affected packages

• Maven org.springframework.security:spring-security-core: < 4.2.13 → fixed in 4.2.13 • Maven org.springframework.security:spring-security-cas: < 4.2.13.RELEASE → fixed in 4.2.13.RELEASE

Description

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of ?null?.

Related

Alias · CVE (1)

  • CVE-2019-11272 Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References