Skip to content
OpenAdvisories
High · 8.2 CVE-2024-22257 EUVD-2024-0908GHSA-f3jh-qvm4-mg39

Erroneous authentication pass in Spring Security

Published Mar 18, 2024 · Updated Jun 30, 2026 · Assigned by vmware

Package: org.springframework.security:spring-security-core Ecosystem: Maven

Description

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to
5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8,
versions 6.2.x prior to 6.2.3, an application is possible vulnerable to
broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

Affected products

VendorProductAffectedFixed
— Spring Security 6.2.0 to 6.2.2, 6.1.0 to 6.1.7, 6.0.0 to 6.0.9, 5.8.0 to 5.8.10, 5.7.0 to 5.7.11 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.springframework.security:spring-security-core < 5.7.12 5.7.12 GHSA-f3jh-qvm4-mg39
Maven org.springframework.security:spring-security-core >= 5.8.0, < 5.8.11 5.8.11 GHSA-f3jh-qvm4-mg39
Maven org.springframework.security:spring-security-core >= 6.0.0, < 6.1.8 6.1.8 GHSA-f3jh-qvm4-mg39
Maven org.springframework.security:spring-security-core >= 6.2.0, < 6.2.3 6.2.3 GHSA-f3jh-qvm4-mg39

Advisories 15

References