org.springframework.security:spring-security-web 5.8.4 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.security:spring-security-web package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
M Authorization Bypass org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Authorization Bypass due to the use of `String.toLowerCase()` and `String.toUpperCase()` that have `Locale` dependent exceptions, which results in authorization rules not working properly. How to fix Authorization Bypass? Upgrade `org.springframework.security:spring-security-web` to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.	[,5.7.14)[5.8.0,5.8.16)[6.2.0,6.2.8)[6.3.0,6.3.5)
C Missing Authorization org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Missing Authorization allowing Spring Security authorization rules to be bypassed for static resources. Note: Non-Static Resources Are Not Affected by this vulnerability. This is because handlers for these routes use predicates to validate the requests even if all security filters are bypassed. Spring Security states that for this to impact an application, all of the following conditions must be met: It must be a WebFlux application. It must be using Spring's static resources support. It must have a non-permitAll authorization rule applied to the static resources support. How to fix Missing Authorization? Upgrade `org.springframework.security:spring-security-web` to version 5.7.13, 5.8.15, 6.2.7, 6.3.4 or higher.	[,5.7.13)[5.8.0,5.8.15)[6.0.0,6.2.7)[6.3.0,6.3.4)

Vulnerability

Vulnerable Version

Authorization Bypass

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authorization Bypass due to the use of String.toLowerCase() and String.toUpperCase() that have Locale dependent exceptions, which results in authorization rules not working properly.

How to fix Authorization Bypass?

Upgrade org.springframework.security:spring-security-web to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.

[,5.7.14)[5.8.0,5.8.16)[6.2.0,6.2.8)[6.3.0,6.3.5)

Missing Authorization

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Missing Authorization allowing Spring Security authorization rules to be bypassed for static resources.

Note:

Non-Static Resources Are Not Affected by this vulnerability. This is because handlers for these routes use predicates to validate the requests even if all security filters are bypassed.

Spring Security states that for this to impact an application, all of the following conditions must be met:

It must be a WebFlux application.
It must be using Spring's static resources support.
It must have a non-permitAll authorization rule applied to the static resources support.

How to fix Missing Authorization?

Upgrade org.springframework.security:spring-security-web to version 5.7.13, 5.8.15, 6.2.7, 6.3.4 or higher.

[,5.7.13)[5.8.0,5.8.15)[6.0.0,6.2.7)[6.3.0,6.3.4)

org.springframework.security:spring-security-web@5.8.4 vulnerabilities

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package manager

Direct Vulnerabilities

How to fix?