CVE-2025-22228

Опубликовано: 20 мар. 2025

Источник: nvd

CVSS3: 7.4

EPSS Низкий

Описание

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Ссылки

https://spring.io/security/cve-2025-22228
https://security.netapp.com/advisory/ntap-20250425-0009/

EPSS

Процентиль: 31%

0.00119

Низкий

7.4 High

CVSS3

Дефекты

CWE-287

Связанные уязвимости

CVE-2025-22228

CVSS3: 7.4

redhat

11 месяцев назад

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

CVE-2025-22228

CVSS3: 7.4

debian

11 месяцев назад

BCryptPasswordEncoder.matches(CharSequence,String)will incorrectly ret ...

GHSA-mg83-c7gq-rv5c

CVSS3: 7.4

github

11 месяцев назад

Spring Security Does Not Enforce Password Length

EPSS

Процентиль: 31%

0.00119

Низкий

7.4 High

CVSS3

Дефекты

CWE-287