CVE-2021-22112
High
Description
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Pivotal Software Spring Security
PublishedFeb 23, 2021
First seenFeb 23, 2021
How to fix
Update
- pivotal_software spring_security5.2.9, 5.3.8 or later
- vmware spring_security5.4.4 or later
- org.springframework.security:spring-security-bom5.4.4, 5.3.8, 5.2.9 or later
- org.springframework.security:spring-security-web5.4.4, 5.3.8, 5.2.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pivotal_software spring_security | v < 5.2.9, 5.3.0 ≤ v < 5.3.8 | 5.2.9, 5.3.8 |
| vmware spring_security | 5.4.0 ≤ v < 5.4.4 | 5.4.4 |
| oracle communications_element_manager | 8.2.0 ≤ v ≤ 8.2.4.0 | — |
| oracle communications_interactive_session_recorder | 6.3, 6.4 | — |
| oracle communications_unified_inventory_management | 7.4.1 | — |
| oracle hospitality_cruise_shipboard_property_management_system | 20.1.0 | — |
| oracle insurance_policy_administration | 11.2.0, 11.3.0 | — |
| oracle mysql_enterprise_monitor | v ≤ 8.0.25 | — |
| org.springframework.security:spring-security-bomMaven | 5.4.0 ≤ v < 5.4.4, 5.3.0 ≤ v < 5.3.8, v < 5.2.9 | 5.4.4, 5.3.8, 5.2.9 |
| org.springframework.security:spring-security-webMaven | 5.4.0 ≤ v < 5.4.4, 5.3.0 ≤ v < 5.3.8, v < 5.2.9 | 5.4.4, 5.3.8, 5.2.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.