QID 983486

QID 983486: Java (maven) Security Update for org.springframework.security:spring-security-core (GHSA-v596-fwhq-8x48)

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.

CVSS V3 rated as Medium - 5.3 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Customers are advised to refer to GHSA-v596-fwhq-8x48 for updates pertaining to this vulnerability.

Vendor References

GHSA-v596-fwhq-8x48 - github.com/advisories/GHSA-v596-fwhq-8x48

CVEs related to QID 983486

CVE-2018-1199 |

Software Advisories

Advisory ID	Software	Link
GHSA-v596-fwhq-8x48	org.springframework.security:spring-security-core	github.com/advisories/GHSA-v596-fwhq-8x48
GHSA-v596-fwhq-8x48	org.springframework.security:spring-security-core	github.com/advisories/GHSA-v596-fwhq-8x48
GHSA-v596-fwhq-8x48	org.springframework:spring-core	github.com/advisories/GHSA-v596-fwhq-8x48

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].