Skip to content
OpenAdvisories

Product · Pivotal

Spring Security

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.3
    CVE-2014-0097

    Improper Authentication in Spring Security

    The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.

    Pivotal Spring Security org.springframework.security:spring-security-core Maven
  • High 7.5
    CVE-2016-5007

    Spring Security and Spring Framework may not recognize certain paths that should be protected

    Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms,…

    Pivotal Spring Framework Spring Security libspring-java Debian Ubuntu Maven