GHSA-8crv-49fr-2h6j CVE-2016-5007
Spring Security and Spring Framework may not recognize certain paths that should be protected
- Severity
- 7.5 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 2.80%
- Chance of exploitation in the next 30 days. Higher than 86.48% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- Available
- 2 packages have a fixed version
Description
Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x (as well as other unsupported versions) rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.springframework.security:spring-security-core | < 4.1.1 |
4.1.1 |
| org.springframework:spring-core | < 4.3.1 |
4.3.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.springframework.security:spring-security-core Maven → 4.1.1
- maven
<dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-core</artifactId><version>4.1.1</version></dependency>- gradle
implementation("org.springframework.security:spring-security-core:4.1.1")
org.springframework:spring-core Maven → 4.3.1
- maven
<dependency><groupId>org.springframework</groupId><artifactId>spring-core</artifactId><version>4.3.1</version></dependency>- gradle
implementation("org.springframework:spring-core:4.3.1")
Severity breakdown
CVSS 3.0 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
References
Advisories
Other links
- github.com/spring-projects/spring-security/issues/3964
- github.com/spring-projects/spring-framework/commit/a30ab30e4e9ae021fdda04e9abfc…
- github.com/spring-projects/spring-security/commit/e4c13e3c0ee7f06f59d3b43ca6734…
- pivotal.io/security/cve-2016-5007
- oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- securityfocus.com/bid/91687
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-659m-px2c-25wj Spring Framework Denial of Service via AntPathMatcher | High | Also affects org.springframework:spring-core |
| GHSA-vxf7-qj7q-83fh Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider | Low | Also affects org.springframework.security:spring-security-core |
| GHSA-x2wq-9x2f-fhj7 Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured | Medium | Also affects org.springframework.security:spring-security-core |
| GHSA-vqxh-445g-37fc Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide | Medium | Also affects org.springframework.security:spring-security-core |
| GHSA-jmp9-x22r-554x Spring Framework annotation detection mechanism may result in improper authorization | High | Also affects org.springframework:spring-core |
| GHSA-8v5q-rhf3-jphm Spring Security annotation detection mechanism has authorization bypass | High | Also affects org.springframework.security:spring-security-core |
| GHSA-9pp5-9c7g-4r83 Spring Security authorization bypass for method security annotations on private methods | Critical | Also affects org.springframework.security:spring-security-core |
| GHSA-hh3m-g4qj-4835 Spring Security Vulnerable to Authorization Bypass via Security Annotations | Medium | Also affects org.springframework.security:spring-security-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor