QID 980545

QID 980545: Java (maven) Security Update for org.springframework.security:spring-security-core (GHSA-wmv4-5w76-vp9g)

When using Spring Security's CAS Proxy ticket authentication a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request.

This means if there are access control restrictions on which CAS services can authenticate to one another, those restrictions can be bypassed.

If users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service, then there is no impact to users.

## Mitigation
Users of affected versions should apply the following mitigation:
- Users of 3.2x should upgrade to 3.2.5 or later
- Users of 3.1.x should upgrade to 3.1.7 or later

## Credit
This issue was identified by David Ohsie and brought to our attention by the CAS Development team.

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as High - 7.5 severity.

Solution

Customers are advised to refer to GHSA-wmv4-5w76-vp9g for updates pertaining to this vulnerability.

Vendor References

GHSA-wmv4-5w76-vp9g - github.com/advisories/GHSA-wmv4-5w76-vp9g

CVEs related to QID 980545

CVE-2014-3527 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-wmv4-5w76-vp9g	org.springframework.security:spring-security-core		github.com/advisories/GHSA-wmv4-5w76-vp9g

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].