GHSA-3295-h9qx-r82x CVE-2010-3700
Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 1.69%
- Chance of exploitation in the next 30 days. Higher than 77.03% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
- Fix
2.0.6- Upgrade org.springframework.security:spring-security-core to this version or later
Description
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.acegisecurity:acegi-security | >= 1.0.0, <= 1.0.7 |
No fix yet |
| org.springframework.security:spring-security-core | >= 2.0.0, < 2.0.6 |
2.0.6 |
| org.springframework.security:spring-security-core | >= 3.0.0, < 3.0.4 |
3.0.4 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.springframework.security:spring-security-core Maven → 2.0.6
- maven
<dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-core</artifactId><version>2.0.6</version></dependency>- gradle
implementation("org.springframework.security:spring-security-core:2.0.6")
Weakness
CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
How to prevent it
- Architecture and Design: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-vxf7-qj7q-83fh Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider | Low | Also affects org.springframework.security:spring-security-core |
| GHSA-x2wq-9x2f-fhj7 Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured | Medium | Also affects org.springframework.security:spring-security-core |
| GHSA-vqxh-445g-37fc Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide | Medium | Also affects org.springframework.security:spring-security-core |
| GHSA-8v5q-rhf3-jphm Spring Security annotation detection mechanism has authorization bypass | High | Also affects org.springframework.security:spring-security-core |
| GHSA-9pp5-9c7g-4r83 Spring Security authorization bypass for method security annotations on private methods | Critical | Also affects org.springframework.security:spring-security-core |
| GHSA-hh3m-g4qj-4835 Spring Security Vulnerable to Authorization Bypass via Security Annotations | Medium | Also affects org.springframework.security:spring-security-core |
| GHSA-q3v6-hm2v-pw99 Spring Framework has Authorization Bypass for Case Sensitive Comparisons | Medium | Also affects org.springframework.security:spring-security-core |
| GHSA-hmqf-wpq9-jq83 Spring Security Missing Authorization vulnerability | High | Also affects org.springframework.security:spring-security-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor