Description
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Spring Security | 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.security:spring-security-bom | >= 5.4.0, < 5.4.4 | 5.4.4 | GHSA-gq28-h5vg-8prx |
| Maven | org.springframework.security:spring-security-bom | >= 5.3.0, < 5.3.8 | 5.3.8 | GHSA-gq28-h5vg-8prx |
| Maven | org.springframework.security:spring-security-bom | < 5.2.9 | 5.2.9 | GHSA-gq28-h5vg-8prx |
| Maven | org.springframework.security:spring-security-web | >= 5.4.0, < 5.4.4 | 5.4.4 | GHSA-gq28-h5vg-8prx |
| Maven | org.springframework.security:spring-security-web | >= 5.3.0, < 5.3.8 | 5.3.8 | GHSA-gq28-h5vg-8prx |
| Maven | org.springframework.security:spring-security-web | < 5.2.9 | 5.2.9 | GHSA-gq28-h5vg-8prx |
Advisories 1
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
References
- [oss-security] 20210219 Vulnerability in Jenkins mailing-list
- [nifi-issues] 20210510 [GitHub] [nifi] exceptionfactory opened a new pull request #5066: NIFI-8502 Upgrade Spring Framework to 5.3.6 mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://tanzu.vmware.com/security/cve-2021-22112
- [portals-pluto-dev] 20210623 [jira] [Closed] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.0 due to CVE-2021-22112 mailing-list
- [portals-pluto-dev] 20210623 [jira] [Updated] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.0 due to CVE-2021-22112 mailing-list
- [portals-pluto-scm] 20210623 [portals-pluto] branch master updated: PLUTO-786 Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.0 due to CVE-2021-22112 mailing-list
- [portals-pluto-dev] 20210714 [jira] [Updated] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119 mailing-list
- [portals-pluto-dev] 20210714 [jira] [Reopened] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119 mailing-list
- [portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119 mailing-list
- [portals-pluto-dev] 20210714 [jira] [Reopened] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.0 due to CVE-2021-22112 mailing-list
- [portals-pluto-dev] 20210714 [jira] [Comment Edited] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119 mailing-list
- [portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-786 Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119 mailing-list
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html