Description
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pivotal | Spring Framework | 5.0.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework:spring-core | >= 5.0.5.RELEASE, < 5.0.6.RELEASE | 5.0.6.RELEASE | GHSA-cxrj-66c5-9fmh |
Advisories 2
- WID-SEC-2025-1660 Oracle Utilities: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 28, 2025
- WID-SEC-2025-1212 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 2, 2025
References
- 104222 vdb-entry
- 1041888 vdb-entry
- 1041896 vdb-entry
- RHSA-2019:2413 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://security.netapp.com/advisory/ntap-20181018-0002/
- https://pivotal.io/security/cve-2018-1258
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html