Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Security ausnutzen, um einen Denial of Service zu verursachen, beliebigen Code auszuführen, Benutzer auf beliebige Websites umzuleiten, Informationen offenzulegen und die Identität eines anderen Benutzers anzunehmen.
Product
Spring Security ist ein Framework, das Authentifizierung, Autorisierung und Schutz vor gängigen Angriffen bietet.
Vulnerabilities 7
-
High 7.6
Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 t…
-
High 7.5
Unbounded DEFLATE Inflation in SAML 2.0 Service Provider
An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory. Affected versions: …
-
High 7.3
Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption…
-
Medium 6.8
Unauthorized User Impersonation when Using X.509 Client Certificates
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. A…
-
Medium 6.1
Spring Security Authorization Server Open Redirect via request_uri
Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unvalidated redirect_uri, …
-
Medium 6.1
Open Redirect When Using CookieRequestCache
Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute…
-
Low 3.7
SAML Payloads Decrypted Without Valid Signature
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affe…
Revision history
-
#3
Neue Updates von Dell aufgenommen
-
#2
Neue Updates von IBM aufgenommen
-
#1
Initiale Fassung
References
-
Spring Security Advisories vom 2026-06-09
https://spring.io/security/cve-2026-40988
-
Spring Security Advisories vom 2026-06-09
https://spring.io/security/cve-2026-40993
-
Spring Security Advisories vom 2026-06-09
https://spring.io/security/cve-2026-41003
-
Spring Security Advisories vom 2026-06-09
https://spring.io/security/cve-2026-41008
-
Spring Security Advisories vom 2026-06-09
https://spring.io/security/cve-2026-41694
-
Spring Security Advisories vom 2026-06-09
https://spring.io/security/cve-2026-41706
-
Spring Security Advisories vom 2026-06-09
https://spring.io/security/cve-2026-47838
-
IBM Security Bulletin 7283059 vom 2026-08-10
https://www.ibm.com/support/pages/node/7283059
-
Dell Security Advisory DSA-2026-385 vom 2026-08-31
https://www.dell.com/support/kbdoc/de-de/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities