org.springframework.security:spring-security-web 4.2.20.RELEASE

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.security:spring-security-web package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Use of Cache Containing Sensitive Information org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the process of writing HTTP response headers for servlet applications. An attacker can manipulate HTTP responses by exploiting the failure to write expected headers, potentially leading to unauthorized access or information disclosure. How to fix Use of Cache Containing Sensitive Information? Upgrade `org.springframework.security:spring-security-web` to version 6.5.9, 7.0.4 or higher.	[,6.5.9)[7.0.0-M1,7.0.4)
M Authorization Bypass org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Authorization Bypass due to the use of `String.toLowerCase()` and `String.toUpperCase()` that have `Locale` dependent exceptions, which results in authorization rules not working properly. How to fix Authorization Bypass? Upgrade `org.springframework.security:spring-security-web` to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.	[,5.7.14)[5.8.0,5.8.16)[6.2.0,6.2.8)[6.3.0,6.3.5)
C Missing Authorization org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Missing Authorization allowing Spring Security authorization rules to be bypassed for static resources. Note: Non-Static Resources Are Not Affected by this vulnerability. This is because handlers for these routes use predicates to validate the requests even if all security filters are bypassed. Spring Security states that for this to impact an application, all of the following conditions must be met: It must be a WebFlux application. It must be using Spring's static resources support. It must have a non-permitAll authorization rule applied to the static resources support. How to fix Missing Authorization? Upgrade `org.springframework.security:spring-security-web` to version 5.7.13, 5.8.15, 6.2.7, 6.3.4 or higher.	[,5.7.13)[5.8.0,5.8.15)[6.0.0,6.2.7)[6.3.0,6.3.4)
H Authorization Bypass org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Authorization Bypass via the `RegexRequestMatcher` class, which can easily be misconfigured to be bypassed on some servlet containers when it is used with `.` in the regular expression. How to fix Authorization Bypass? Upgrade `org.springframework.security:spring-security-web` to version 5.4.11, 5.5.7, 5.6.4 or higher.	[,5.4.11)[5.5.0,5.5.7)[5.6.0,5.6.4)
L Timing Attack org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Timing Attack. It is possible for an attacker to steal CSRF tokens through a timing attack. How to fix Timing Attack? Upgrade `org.springframework.security:spring-security-web` to version 5.2.9.RELEASE, 5.3.7, 5.4.3 or higher.	[,5.2.9.RELEASE)[5.3.0,5.3.7)[5.4.0,5.4.3)

Vulnerability

Vulnerable Version

Use of Cache Containing Sensitive Information

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the process of writing HTTP response headers for servlet applications. An attacker can manipulate HTTP responses by exploiting the failure to write expected headers, potentially leading to unauthorized access or information disclosure.

How to fix Use of Cache Containing Sensitive Information?

Upgrade org.springframework.security:spring-security-web to version 6.5.9, 7.0.4 or higher.

[,6.5.9)[7.0.0-M1,7.0.4)

Authorization Bypass

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authorization Bypass due to the use of String.toLowerCase() and String.toUpperCase() that have Locale dependent exceptions, which results in authorization rules not working properly.

How to fix Authorization Bypass?

Upgrade org.springframework.security:spring-security-web to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.

[,5.7.14)[5.8.0,5.8.16)[6.2.0,6.2.8)[6.3.0,6.3.5)

Missing Authorization

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Missing Authorization allowing Spring Security authorization rules to be bypassed for static resources.

Note:

Non-Static Resources Are Not Affected by this vulnerability. This is because handlers for these routes use predicates to validate the requests even if all security filters are bypassed.

Spring Security states that for this to impact an application, all of the following conditions must be met:

It must be a WebFlux application.
It must be using Spring's static resources support.
It must have a non-permitAll authorization rule applied to the static resources support.

How to fix Missing Authorization?

Upgrade org.springframework.security:spring-security-web to version 5.7.13, 5.8.15, 6.2.7, 6.3.4 or higher.

[,5.7.13)[5.8.0,5.8.15)[6.0.0,6.2.7)[6.3.0,6.3.4)

Authorization Bypass

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authorization Bypass via the RegexRequestMatcher class, which can easily be misconfigured to be bypassed on some servlet containers when it is used with . in the regular expression.

How to fix Authorization Bypass?

Upgrade org.springframework.security:spring-security-web to version 5.4.11, 5.5.7, 5.6.4 or higher.

[,5.4.11)[5.5.0,5.5.7)[5.6.0,5.6.4)

Timing Attack

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Timing Attack. It is possible for an attacker to steal CSRF tokens through a timing attack.

How to fix Timing Attack?

Upgrade org.springframework.security:spring-security-web to version 5.2.9.RELEASE, 5.3.7, 5.4.3 or higher.

[,5.2.9.RELEASE)[5.3.0,5.3.7)[5.4.0,5.4.3)

org.springframework.security:spring-security-web@4.2.20.RELEASE

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically