org.springframework.security:spring-security-web 5.6.7 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.security:spring-security-web package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
M Authorization Bypass org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Authorization Bypass due to the use of `String.toLowerCase()` and `String.toUpperCase()` that have `Locale` dependent exceptions, which results in authorization rules not working properly. How to fix Authorization Bypass? Upgrade `org.springframework.security:spring-security-web` to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.	[,5.7.14)[5.8.0,5.8.16)[6.2.0,6.2.8)[6.3.0,6.3.5)
C Missing Authorization org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Missing Authorization allowing Spring Security authorization rules to be bypassed for static resources. Note: Non-Static Resources Are Not Affected by this vulnerability. This is because handlers for these routes use predicates to validate the requests even if all security filters are bypassed. Spring Security states that for this to impact an application, all of the following conditions must be met: It must be a WebFlux application. It must be using Spring's static resources support. It must have a non-permitAll authorization rule applied to the static resources support. How to fix Missing Authorization? Upgrade `org.springframework.security:spring-security-web` to version 5.7.13, 5.8.15, 6.2.7, 6.3.4 or higher.	[,5.7.13)[5.8.0,5.8.15)[6.0.0,6.2.7)[6.3.0,6.3.4)
H Authorization Bypass org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Authorization Bypass via forward or include dispatcher types. An application is vulnerable when all of the following are `true`: The application expects that Spring Security applies security to forward and include dispatcher types. The application uses the `AuthorizationFilter` either manually or via the `authorizeHttpRequests()` method. The application configures the `FilterChainProxy` to apply to forward and/or include requests (e.g. `spring.security.filter.dispatcher-types = request, error, async, forward, include`). The application may forward or include the request to a higher privilege-secured endpoint. The application configures Spring Security to apply to every dispatcher type via `authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)` An application is not* vulnerable if any of the following is true*: The application does not use `authorizeHttpRequests()` or the `AuthorizationFilter`. The application does not forward/include requests. The application does not need to configure Spring Security to apply to `FORWARD` and `INCLUDE` dispatcher types. How to fix Authorization Bypass? Upgrade `org.springframework.security:spring-security-web` to version 5.6.9, 5.7.5 or higher.	[5.6.0,5.6.9)[5.7.0,5.7.5)

Vulnerability

Vulnerable Version

Authorization Bypass

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authorization Bypass due to the use of String.toLowerCase() and String.toUpperCase() that have Locale dependent exceptions, which results in authorization rules not working properly.

How to fix Authorization Bypass?

Upgrade org.springframework.security:spring-security-web to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.

[,5.7.14)[5.8.0,5.8.16)[6.2.0,6.2.8)[6.3.0,6.3.5)

Missing Authorization

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Missing Authorization allowing Spring Security authorization rules to be bypassed for static resources.

Note:

Non-Static Resources Are Not Affected by this vulnerability. This is because handlers for these routes use predicates to validate the requests even if all security filters are bypassed.

Spring Security states that for this to impact an application, all of the following conditions must be met:

It must be a WebFlux application.
It must be using Spring's static resources support.
It must have a non-permitAll authorization rule applied to the static resources support.

How to fix Missing Authorization?

Upgrade org.springframework.security:spring-security-web to version 5.7.13, 5.8.15, 6.2.7, 6.3.4 or higher.

[,5.7.13)[5.8.0,5.8.15)[6.0.0,6.2.7)[6.3.0,6.3.4)

Authorization Bypass

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authorization Bypass via forward or include dispatcher types.

An application is vulnerable when all of the following are true:

The application expects that Spring Security applies security to forward and include dispatcher types.
The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method.
The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include).
The application may forward or include the request to a higher privilege-secured endpoint.
The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)

An application is not vulnerable if any of the following is true:

The application does not use authorizeHttpRequests() or the AuthorizationFilter.
The application does not forward/include requests.
The application does not need to configure Spring Security to apply to FORWARD and INCLUDE dispatcher types.

How to fix Authorization Bypass?

Upgrade org.springframework.security:spring-security-web to version 5.6.9, 5.7.5 or higher.

[5.6.0,5.6.9)[5.7.0,5.7.5)

org.springframework.security:spring-security-web@5.6.7 vulnerabilities

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

How to fix?