Dictionary attack with Spring Security queryable text encryptor
Priority LOW 32CWE-329Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
Why it matters now
EPSS 0.01594 75th percentileScored 2026-11-07
Fix Fixed Spring Security (Spring by VMware): 4.2.16, 5.0.16, 5.1.10 +2org.springframework.security:spring-security-core (Maven): 5.3.2, 5.2.4, 5.1.10 +2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Spring Security | 4.2 to before 4.2.16; 5.0 to before 5.0.16; 5.1 to before 5.1.10; 5.2 to before 5.2.4; 5.3 to before 5.3.2 | 4.2.16, 5.0.16, 5.1.10, 5.2.4, 5.3.2 | Patch available | CNA |
| — | org.springframework.security:spring-security-core (Maven) | 5.3.0 to before 5.3.2 | 5.3.2 | Patch available | GHSA-2ppp-9496-p23q |
| — | org.springframework.security:spring-security-core (Maven) | 5.2.0 to before 5.2.4 | 5.2.4 | Patch available | GHSA-2ppp-9496-p23q |
| — | org.springframework.security:spring-security-core (Maven) | 5.1.0 to before 5.1.10 | 5.1.10 | Patch available | GHSA-2ppp-9496-p23q |
| — | org.springframework.security:spring-security-core (Maven) | 5.0.0 to before 5.0.16 | 5.0.16 | Patch available | GHSA-2ppp-9496-p23q |
| — | org.springframework.security:spring-security-core (Maven) | before 4.2.16 | 4.2.16 | Patch available | GHSA-2ppp-9496-p23q |
- Spring Security VendorVMware Affected 4.2 to before 4.2.16; 5.0 to before 5.0.16; 5.1 to before 5.1.10; 5.2 to before 5.2.4; 5.3 to before 5.3.2 Fixed in 4.2.16, 5.0.16, 5.1.10, 5.2.4, 5.3.2 Patch available CNA
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 5.3.0 to before 5.3.2 Fixed in 5.3.2 Patch available GHSA-2ppp-9496-p23q
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 5.2.0 to before 5.2.4 Fixed in 5.2.4 Patch available GHSA-2ppp-9496-p23q
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 5.1.0 to before 5.1.10 Fixed in 5.1.10 Patch available GHSA-2ppp-9496-p23q
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 5.0.0 to before 5.0.16 Fixed in 5.0.16 Patch available GHSA-2ppp-9496-p23q
- org.springframework.security:spring-security-core (Maven) Vendor— Affected before 4.2.16 Fixed in 4.2.16 Patch available GHSA-2ppp-9496-p23q
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pivotal_software:spring_security:*:*:*:*:*:*:*:* | 5.2.0 to before 5.2.4; 5.3.0 to before 5.3.2 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* | 4.2.0 to before 4.2.16; 5.0.0 to before 5.0.16; 5.1.0 to before 5.1.10 | Vulnerable | VMware |
- cpe:2.3:a:pivotal_software:spring_security:*:*:*:*:*:*:*:* Versions 5.2.0 to before 5.2.4; 5.3.0 to before 5.3.2 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* Versions 4.2.0 to before 4.2.16; 5.0.0 to before 5.0.16; 5.1.0 to before 5.1.10 Vulnerable ·VMware
Remediation
- Fix · CNA Spring Security (Spring by VMware) Fixed in 4.2.16, 5.0.16, 5.1.10, 5.2.4, 5.3.2
- Fix · GHSA-2ppp-9496-p23q org.springframework.security:spring-security-core (Maven) Fixed in 5.3.2 Advisory →
- Fix · GHSA-2ppp-9496-p23q org.springframework.security:spring-security-core (Maven) Fixed in 5.2.4 Advisory →
- Fix · GHSA-2ppp-9496-p23q org.springframework.security:spring-security-core (Maven) Fixed in 5.1.10 Advisory →
- Fix · GHSA-2ppp-9496-p23q org.springframework.security:spring-security-core (Maven) Fixed in 5.0.16 Advisory →
- Fix · GHSA-2ppp-9496-p23q org.springframework.security:spring-security-core (Maven) Fixed in 4.2.16 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5408
- 2026-10-03 Alias added: GHSA-2ppp-9496-p23q
References
More VMware Spring Security vulnerabilities
- TI-2023-16900 Improper access control in Spring Security CVSS 3.1CRITICAL 9.8
- TI-2022-13611 Authorization bypass in Spring by VMware CVSS 3.1CRITICAL 9.8
- TI-2022-07154 Incorrect authorization in Spring Security CVSS 3.1CRITICAL 9.8
- TI-2026-42404 Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces CVSS 3.1CRITICAL 9.4
- TI-2026-18257 Under Some Conditions Spring Security HTTP Headers Are not Written CVSS 3.1CRITICAL 9.1
- TI-2014-02853 Improper authentication in Pivotal Spring Security CVSS 3.0CRITICAL 9.8
Sources
- CVE-2020-5408 · CVE Program
- CVE-2020-5408 · NVD
- FIRST EPSS
- GHSA-2ppp-9496-p23q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences