CVE-2024-38821
Critical
Description
Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support
SeverityCritical
CVSS9.1
Exploit probability—
ProductOrg.springframework.security:spring-security-web
PublishedOct 28, 2024
First seenOct 28, 2024
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- org.springframework.security:spring-security-web5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework.security:spring-security-webMaven | 5.0.0 ≤ v < 5.7.13, 5.8.0 ≤ v < 5.8.15, 6.2.0 ≤ v < 6.2.7, 6.0.0 ≤ v < 6.0.13, 6.1.0 ≤ v < 6.1.11, 6.3.0 ≤ v < 6.3.4 | 5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.