org.springframework.security:spring-security-web@5.7.0 vulnerabilities
-
latest version
6.3.0
-
latest non vulnerable version
-
first published
14 years ago
-
latest version published
5 days ago
-
licenses detected
- [3.0.0.RELEASE,)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.springframework.security:spring-security-web package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.Vulnerability | Vulnerable Version |
---|---|
org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Session Fixation due to the logout functionality not properly clearing the security context when using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the NOTE: Applications are only vulnerable if any of the following conditions are true:
How to fix Session Fixation? Upgrade |
[5.7.0,5.7.8)
[5.8.0,5.8.3)
[6.0.0,6.0.3)
|
org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Authorization Bypass via forward or include dispatcher types. An application is vulnerable when all of the following are
An application is not vulnerable if any of the following is true:
How to fix Authorization Bypass? Upgrade |
[5.6.0,5.6.9)
[5.7.0,5.7.5)
|