CVE-2024-22257

Published: Mar 18, 2024Modified: Jun 30, 2026Deferred

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability: 3.9 / Impact: 4.2

Source: security@vmware.com (Secondary)

Description

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (5)

https://security.netapp.com/advisory/ntap-20240419-0005/

Source: security@vmware.com

https://spring.io/security/cve-2024-22257

Source: security@vmware.com

https://github.com/dependency-check/DependencyCheck/issues/8642

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20240419-0005/

Source: af854a3a-2127-422b-91ae-364da2661108

https://spring.io/security/cve-2024-22257

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.