Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-v33x-prhc-gph5

Опубликовано: 27 июн. 2019
Источник: github
Github: Прошло ревью
CVSS3: 7.3

Описание

Insufficiently Protected Credentials and Improper Authentication in Spring Security

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of ?null?.

Пакеты

Наименование

org.springframework.security:spring-security-core

maven
Затронутые версииВерсия исправления

<= 4.2.12

4.2.13

Наименование

org.springframework.security:spring-security-cas

maven
Затронутые версииВерсия исправления

<= 4.2.12.RELEASE

4.2.13.RELEASE

EPSS

Процентиль: 61%
0.00407
Низкий

7.3 High

CVSS3

Дефекты

CWE-287
CWE-522

Связанные уязвимости

CVSS3: 7.3
ubuntu
больше 6 лет назад

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".

CVSS3: 7.3
redhat
больше 6 лет назад

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".

CVSS3: 7.3
nvd
больше 6 лет назад

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".

CVSS3: 7.3
debian
больше 6 лет назад

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported ve ...

CVSS3: 7.3
fstec
больше 6 лет назад

Уязвимость реализации класса PlaintextPasswordEncoder Java-фреймворка для обеспечения безопасности промышленных приложений Spring Security, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

EPSS

Процентиль: 61%
0.00407
Низкий

7.3 High

CVSS3

Дефекты

CWE-287
CWE-522