org.springframework.security:spring-security-web 4.2.3.RELEASE vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.security:spring-security-web package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
M Authorization Bypass org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Authorization Bypass due to the use of `String.toLowerCase()` and `String.toUpperCase()` that have `Locale` dependent exceptions, which results in authorization rules not working properly. How to fix Authorization Bypass? Upgrade `org.springframework.security:spring-security-web` to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.	[,5.7.14)[5.8.0,5.8.16)[6.2.0,6.2.8)[6.3.0,6.3.5)
C Missing Authorization org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Missing Authorization allowing Spring Security authorization rules to be bypassed for static resources. Note: Non-Static Resources Are Not Affected by this vulnerability. This is because handlers for these routes use predicates to validate the requests even if all security filters are bypassed. Spring Security states that for this to impact an application, all of the following conditions must be met: It must be a WebFlux application. It must be using Spring's static resources support. It must have a non-permitAll authorization rule applied to the static resources support. How to fix Missing Authorization? Upgrade `org.springframework.security:spring-security-web` to version 5.7.13, 5.8.15, 6.2.7, 6.3.4 or higher.	[,5.7.13)[5.8.0,5.8.15)[6.0.0,6.2.7)[6.3.0,6.3.4)
H Authorization Bypass org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Authorization Bypass via the `RegexRequestMatcher` class, which can easily be misconfigured to be bypassed on some servlet containers when it is used with `.` in the regular expression. How to fix Authorization Bypass? Upgrade `org.springframework.security:spring-security-web` to version 5.4.11, 5.5.7, 5.6.4 or higher.	[,5.4.11)[5.5.0,5.5.7)[5.6.0,5.6.4)
L Timing Attack org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Timing Attack. It is possible for an attacker to steal CSRF tokens through a timing attack. How to fix Timing Attack? Upgrade `org.springframework.security:spring-security-web` to version 5.2.9.RELEASE, 5.3.7, 5.4.3 or higher.	[,5.2.9.RELEASE)[5.3.0,5.3.7)[5.4.0,5.4.3)
M Access Restriction Bypass org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Access Restriction Bypass. It does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. How to fix Access Restriction Bypass? Upgrade `org.springframework.security:spring-security-web` to version 4.1.5.RELEASE, 4.2.4.RELEASE, 5.0.3.RELEASE or higher.	[4.1.0.RELEASE,4.1.5.RELEASE)[4.2.0.RELEASE,4.2.4.RELEASE)[5.0.0.RELEASE,5.0.3.RELEASE)

Vulnerability

Vulnerable Version

Authorization Bypass

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authorization Bypass due to the use of String.toLowerCase() and String.toUpperCase() that have Locale dependent exceptions, which results in authorization rules not working properly.

How to fix Authorization Bypass?

Upgrade org.springframework.security:spring-security-web to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.

[,5.7.14)[5.8.0,5.8.16)[6.2.0,6.2.8)[6.3.0,6.3.5)

Missing Authorization

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Missing Authorization allowing Spring Security authorization rules to be bypassed for static resources.

Note:

Non-Static Resources Are Not Affected by this vulnerability. This is because handlers for these routes use predicates to validate the requests even if all security filters are bypassed.

Spring Security states that for this to impact an application, all of the following conditions must be met:

It must be a WebFlux application.
It must be using Spring's static resources support.
It must have a non-permitAll authorization rule applied to the static resources support.

How to fix Missing Authorization?

Upgrade org.springframework.security:spring-security-web to version 5.7.13, 5.8.15, 6.2.7, 6.3.4 or higher.

[,5.7.13)[5.8.0,5.8.15)[6.0.0,6.2.7)[6.3.0,6.3.4)

Authorization Bypass

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authorization Bypass via the RegexRequestMatcher class, which can easily be misconfigured to be bypassed on some servlet containers when it is used with . in the regular expression.

How to fix Authorization Bypass?

Upgrade org.springframework.security:spring-security-web to version 5.4.11, 5.5.7, 5.6.4 or higher.

[,5.4.11)[5.5.0,5.5.7)[5.6.0,5.6.4)

Timing Attack

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Timing Attack. It is possible for an attacker to steal CSRF tokens through a timing attack.

How to fix Timing Attack?

Upgrade org.springframework.security:spring-security-web to version 5.2.9.RELEASE, 5.3.7, 5.4.3 or higher.

[,5.2.9.RELEASE)[5.3.0,5.3.7)[5.4.0,5.4.3)

Access Restriction Bypass

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Access Restriction Bypass. It does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint.

How to fix Access Restriction Bypass?

Upgrade org.springframework.security:spring-security-web to version 4.1.5.RELEASE, 4.2.4.RELEASE, 5.0.3.RELEASE or higher.

[4.1.0.RELEASE,4.1.5.RELEASE)[4.2.0.RELEASE,4.2.4.RELEASE)[5.0.0.RELEASE,5.0.3.RELEASE)

org.springframework.security:spring-security-web@4.2.3.RELEASE vulnerabilities

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

How to fix?