org.springframework.security:spring-security-core (Maven)
Advisories
78
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 7.0.5 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-core</artifactId><version>7.0.5</version></dependency>gradle
implementation("org.springframework.security:spring-security-core:7.0.5")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-vxf7-qj7q-83fh Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider |
Low EPSS 0.21% |
>= 6.5.0, < 6.5.10 | 6.5.10 |
| GHSA-vxf7-qj7q-83fh Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider |
Low EPSS 0.21% |
>= 7.0.0, < 7.0.5 | 7.0.5 |
| GHSA-vxf7-qj7q-83fh Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider |
Low EPSS 0.21% |
>= 5.7.0, <= 5.7.22 | No fix yet |
| GHSA-vxf7-qj7q-83fh Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider |
Low EPSS 0.21% |
>= 5.8.0, <= 5.8.24 | No fix yet |
| GHSA-vxf7-qj7q-83fh Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider |
Low EPSS 0.21% |
>= 6.3.0, <= 6.3.15 | No fix yet |
| GHSA-vxf7-qj7q-83fh Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider |
Low EPSS 0.21% |
>= 6.4.0, <= 6.4.15 | No fix yet |
| GHSA-x2wq-9x2f-fhj7 Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured |
Medium EPSS 0.12% |
>= 6.5.0, < 6.5.10 | 6.5.10 |
| GHSA-x2wq-9x2f-fhj7 Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured |
Medium EPSS 0.12% |
>= 6.4.0, <= 6.4.13 | No fix yet |
| GHSA-x2wq-9x2f-fhj7 Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured |
Medium EPSS 0.12% |
>= 7.0.3, < 7.0.5 | 7.0.5 |
| GHSA-vqxh-445g-37fc Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide |
Medium EPSS 0.39% |
>= 6.3.8, < 6.3.9 | 6.3.9 |
| GHSA-vqxh-445g-37fc Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide |
Medium EPSS 0.39% |
>= 6.4.4, < 6.4.5 | 6.4.5 |
| GHSA-8v5q-rhf3-jphm Spring Security annotation detection mechanism has authorization bypass |
High EPSS 0.45% |
>= 6.5.0, < 6.5.4 | 6.5.4 |
| GHSA-8v5q-rhf3-jphm Spring Security annotation detection mechanism has authorization bypass |
High EPSS 0.45% |
>= 6.4.0, < 6.4.10 | 6.4.10 |
| GHSA-9pp5-9c7g-4r83 Spring Security authorization bypass for method security annotations on private methods |
Critical EPSS 0.62% |
>= 6.4.0, < 6.4.6 | 6.4.6 |
| GHSA-hh3m-g4qj-4835 Spring Security Vulnerable to Authorization Bypass via Security Annotations |
Medium EPSS 0.51% |
>= 6.4.0, < 6.4.4 | 6.4.4 |
| GHSA-q3v6-hm2v-pw99 Spring Framework has Authorization Bypass for Case Sensitive Comparisons |
Medium EPSS 0.38% |
>= 6.1.0, < 6.1.12 | 6.1.12 |
| GHSA-q3v6-hm2v-pw99 Spring Framework has Authorization Bypass for Case Sensitive Comparisons |
Medium EPSS 0.38% |
>= 6.2.0, < 6.2.8 | 6.2.8 |
| GHSA-q3v6-hm2v-pw99 Spring Framework has Authorization Bypass for Case Sensitive Comparisons |
Medium EPSS 0.38% |
< 5.7.14 | 5.7.14 |
| GHSA-q3v6-hm2v-pw99 Spring Framework has Authorization Bypass for Case Sensitive Comparisons |
Medium EPSS 0.38% |
>= 5.8.0, < 5.8.16 | 5.8.16 |
| GHSA-q3v6-hm2v-pw99 Spring Framework has Authorization Bypass for Case Sensitive Comparisons |
Medium EPSS 0.38% |
>= 6.0.0, < 6.0.14 | 6.0.14 |
| GHSA-q3v6-hm2v-pw99 Spring Framework has Authorization Bypass for Case Sensitive Comparisons |
Medium EPSS 0.38% |
>= 6.3.0, < 6.3.5 | 6.3.5 |
| GHSA-hmqf-wpq9-jq83 Spring Security Missing Authorization vulnerability |
High EPSS 0.46% |
>= 6.3.0, < 6.3.2 | 6.3.2 |
| GHSA-f3jh-qvm4-mg39 Erroneous authentication pass in Spring Security |
High EPSS 0.96% |
>= 6.0.0, < 6.1.8 | 6.1.8 |
| GHSA-f3jh-qvm4-mg39 Erroneous authentication pass in Spring Security |
High EPSS 0.96% |
>= 5.8.0, < 5.8.11 | 5.8.11 |
| GHSA-f3jh-qvm4-mg39 Erroneous authentication pass in Spring Security |
High EPSS 0.96% |
>= 6.2.0, < 6.2.3 | 6.2.3 |
| GHSA-f3jh-qvm4-mg39 Erroneous authentication pass in Spring Security |
High EPSS 0.96% |
< 5.7.12 | 5.7.12 |
| GHSA-w3w6-26f2-p474 Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated |
High EPSS 0.68% |
>= 6.1.0, < 6.1.7 | 6.1.7 |
| GHSA-w3w6-26f2-p474 Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated |
High EPSS 0.68% |
>= 6.2.0, < 6.2.2 | 6.2.2 |
| GHSA-x873-6rgc-94jc Spring Security logout not clearing security context |
Medium EPSS 0.65% |
>= 6.0.0, < 6.0.3 | 6.0.3 |
| GHSA-x873-6rgc-94jc Spring Security logout not clearing security context |
Medium EPSS 0.65% |
>= 5.7.0, < 5.7.8 | 5.7.8 |
| GHSA-x873-6rgc-94jc Spring Security logout not clearing security context |
Medium EPSS 0.65% |
>= 5.8.0, < 5.8.3 | 5.8.3 |
| GHSA-mmmh-wcxm-2wr4 Spring Security authorization rules can be bypassed via forward or include dispatcher types |
Critical EPSS 4.25% |
>= 5.6.0, < 5.6.9 | 5.6.9 |
| GHSA-mmmh-wcxm-2wr4 Spring Security authorization rules can be bypassed via forward or include dispatcher types |
Critical EPSS 4.25% |
>= 5.7.0, < 5.7.5 | 5.7.5 |
| GHSA-hh32-7344-cg2f Authorization bypass in Spring Security |
Critical EPSS 12.35% |
>= 5.5.0, < 5.5.7 | 5.5.7 |
| GHSA-hh32-7344-cg2f Authorization bypass in Spring Security |
Critical EPSS 12.35% |
>= 5.6.0, < 5.6.4 | 5.6.4 |
| GHSA-hh32-7344-cg2f Authorization bypass in Spring Security |
Critical EPSS 12.35% |
< 5.4.11 | 5.4.11 |
| GHSA-wx54-3278-m5g4 Integer overflow in BCrypt class in Spring Security |
Medium EPSS 2.34% |
>= 5.6.0, < 5.6.4 | 5.6.4 |
| GHSA-wx54-3278-m5g4 Integer overflow in BCrypt class in Spring Security |
Medium EPSS 2.34% |
>= 5.2.0.RELEASE, < 5.5.7 | 5.5.7 |
| GHSA-5xm9-rf63-wj7h Improper Control of Generation of Code in Spring Security |
Medium EPSS 4.65% |
< 2.0.7 | 2.0.7 |
| GHSA-5xm9-rf63-wj7h Improper Control of Generation of Code in Spring Security |
Medium EPSS 4.65% |
>= 3.0.0, < 3.0.6 | 3.0.6 |
| GHSA-3533-rvpc-6x56 Exposure of Sensitive Information to an Unauthorized Actor in Spring Security |
Medium EPSS 1.95% |
< 2.0.8 | 2.0.8 |
| GHSA-3533-rvpc-6x56 Exposure of Sensitive Information to an Unauthorized Actor in Spring Security |
Medium EPSS 1.95% |
>= 3.1.0, < 3.1.3 | 3.1.3 |
| GHSA-3533-rvpc-6x56 Exposure of Sensitive Information to an Unauthorized Actor in Spring Security |
Medium EPSS 1.95% |
>= 3.0.0, < 3.0.8 | 3.0.8 |
| GHSA-4644-hg35-55m9 Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security |
Medium EPSS 1.26% |
>= 3.0.0, < 3.0.6 | 3.0.6 |
| GHSA-4644-hg35-55m9 Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security |
Medium EPSS 1.26% |
< 2.0.7 | 2.0.7 |
| GHSA-f866-m9mv-2xr3 Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data |
Medium EPSS 8.60% |
>= 2.0.0, < 2.0.7 | 2.0.7 |
| GHSA-f866-m9mv-2xr3 Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data |
Medium EPSS 8.60% |
>= 3.0.0, < 3.0.6 | 3.0.6 |
| GHSA-3295-h9qx-r82x Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security |
Medium EPSS 1.69% |
>= 3.0.0, < 3.0.4 | 3.0.4 |
| GHSA-3295-h9qx-r82x Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security |
Medium EPSS 1.69% |
>= 2.0.0, < 2.0.6 | 2.0.6 |
| GHSA-vhrg-v3cv-p247 Deserialization of Untrusted Data in Spring Security |
High EPSS 2.55% |
>= 4.2.0.RELEASE, < 4.2.3.RELEASE | 4.2.3.RELEASE |
| GHSA-vhrg-v3cv-p247 Deserialization of Untrusted Data in Spring Security |
High EPSS 2.55% |
>= 5.0.0.M1, < 5.0.0.M2 | 5.0.0.M2 |
| GHSA-gv9v-c375-hvmg Improper Authentication in Spring Security |
High EPSS 1.21% |
>= 3.1.0, < 3.1.5.RELEASE | 3.1.5.RELEASE |
| GHSA-gv9v-c375-hvmg Improper Authentication in Spring Security |
High EPSS 1.21% |
>= 3.2.0, < 3.2.2.RELEASE | 3.2.2.RELEASE |
| GHSA-w9jg-gvgr-354m Resource Exhaustion in Spring Security |
High EPSS 6.00% |
>= 5.4.0, < 5.4.7 | 5.4.7 |
| GHSA-w9jg-gvgr-354m Resource Exhaustion in Spring Security |
High EPSS 6.00% |
>= 5.2.0, < 5.2.11 | 5.2.11 |
| GHSA-w9jg-gvgr-354m Resource Exhaustion in Spring Security |
High EPSS 6.00% |
>= 5.3.0, < 5.3.10 | 5.3.10 |
| GHSA-w9jg-gvgr-354m Resource Exhaustion in Spring Security |
High EPSS 6.00% |
>= 5.5.0, < 5.5.1 | 5.5.1 |
| GHSA-v35c-49j6-q8hq Security Constraint Bypass in Spring Security |
High EPSS 1.46% |
>= 4.0.0.RELEASE, < 4.1.4.RELEASE | 4.1.4.RELEASE |
| GHSA-v35c-49j6-q8hq Security Constraint Bypass in Spring Security |
High EPSS 1.46% |
>= 4.2.0.RELEASE, < 4.2.1.RELEASE | 4.2.1.RELEASE |
| GHSA-v35c-49j6-q8hq Security Constraint Bypass in Spring Security |
High EPSS 1.46% |
< 3.2.10.RELEASE | 3.2.10.RELEASE |
| GHSA-wmv4-5w76-vp9g Authorization Bypass in Spring Security |
Critical EPSS 1.82% |
>= 3.2.0, < 3.2.5 | 3.2.5 |
| GHSA-wmv4-5w76-vp9g Authorization Bypass in Spring Security |
Critical EPSS 1.82% |
< 3.1.7 | 3.1.7 |
| GHSA-2ppp-9496-p23q Insufficient Entropy in Spring Security |
Medium EPSS 1.59% |
< 4.2.16 | 4.2.16 |
| GHSA-2ppp-9496-p23q Insufficient Entropy in Spring Security |
Medium EPSS 1.59% |
>= 5.2.0, < 5.2.4 | 5.2.4 |
| GHSA-2ppp-9496-p23q Insufficient Entropy in Spring Security |
Medium EPSS 1.59% |
>= 5.3.0, < 5.3.2 | 5.3.2 |
| GHSA-2ppp-9496-p23q Insufficient Entropy in Spring Security |
Medium EPSS 1.59% |
>= 5.0.0, < 5.0.16 | 5.0.16 |
| GHSA-2ppp-9496-p23q Insufficient Entropy in Spring Security |
Medium EPSS 1.59% |
>= 5.1.0, < 5.1.10 | 5.1.10 |
| GHSA-48rw-j489-928m Signature wrapping vulnerability in Spring Security |
High EPSS 1.20% |
>= 5.2.0, < 5.2.4 | 5.2.4 |
| GHSA-48rw-j489-928m Signature wrapping vulnerability in Spring Security |
High EPSS 1.20% |
>= 5.3.0, < 5.3.2 | 5.3.2 |
| GHSA-v33x-prhc-gph5 Insufficiently Protected Credentials and Improper Authentication in Spring Security |
High EPSS 1.38% |
< 4.2.13 | 4.2.13 |
| GHSA-v2r2-7qm7-jj6v Spring Security uses insufficiently random values |
Medium EPSS 1.92% |
>= 5.0.0, < 5.0.12 | 5.0.12 |
| GHSA-v2r2-7qm7-jj6v Spring Security uses insufficiently random values |
Medium EPSS 1.92% |
>= 5.1.0, < 5.1.5 | 5.1.5 |
| GHSA-v2r2-7qm7-jj6v Spring Security uses insufficiently random values |
Medium EPSS 1.92% |
>= 4.2.0, < 4.2.12 | 4.2.12 |
| GHSA-27xw-p8v6-9jjr Spring Security vulnerable to Authorization Bypass |
High EPSS 0.65% |
>= 5.1.0, < 5.1.2 | 5.1.2 |
| GHSA-8crv-49fr-2h6j Spring Security and Spring Framework may not recognize certain paths that should be protected |
High EPSS 2.80% |
< 4.1.1 | 4.1.1 |
| GHSA-v596-fwhq-8x48 Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core |
Medium EPSS 2.80% |
>= 4.2.0, < 4.2.4 | 4.2.4 |
| GHSA-v596-fwhq-8x48 Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core |
Medium EPSS 2.80% |
>= 4.1.0, < 4.1.5 | 4.1.5 |
| GHSA-v596-fwhq-8x48 Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core |
Medium EPSS 2.80% |
>= 5.0.0, < 5.0.1 | 5.0.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor