Spring Security

3 results · Feed

• High 7.3
  CVE-2014-0097

  Improper Authentication in Spring Security

  The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.

  Pivotal Spring Security org.springframework.security:spring-security-core Maven
  May 25, 2017
• Critical 9.8
  CVE-2014-3527

  Authorization Bypass in Spring Security

  When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication u…

  Pivotal Spring Security org.springframework.security:spring-security-core Maven
  May 25, 2017
• High 7.5
  CVE-2016-5007

  Spring Security and Spring Framework may not recognize certain paths that should be protected

  Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms,…

  Pivotal Spring Framework Spring Security libspring-java Debian Ubuntu Maven
  May 25, 2017