Improper privilege management in Spring Security
Priority MEDIUM 44CWE-269Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269.
Summary
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
Why it matters now
EPSS 0.03286 88th percentileScored 2026-11-07
Fix Fixed org.springframework.security:spring-security-bom (Maven): 5.4.4, 5.3.8, 5.2.9org.springframework.security:spring-security-web (Maven): 5.4.4, 5.3.8, 5.2.9
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Spring Security | 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE | — | No fix listed | CNA |
| — | org.springframework.security:spring-security-bom (Maven) | 5.4.0 to before 5.4.4 | 5.4.4 | Patch available | GHSA-gq28-h5vg-8prx |
| — | org.springframework.security:spring-security-bom (Maven) | 5.3.0 to before 5.3.8 | 5.3.8 | Patch available | GHSA-gq28-h5vg-8prx |
| — | org.springframework.security:spring-security-bom (Maven) | before 5.2.9 | 5.2.9 | Patch available | GHSA-gq28-h5vg-8prx |
| — | org.springframework.security:spring-security-web (Maven) | 5.4.0 to before 5.4.4 | 5.4.4 | Patch available | GHSA-gq28-h5vg-8prx |
| — | org.springframework.security:spring-security-web (Maven) | 5.3.0 to before 5.3.8 | 5.3.8 | Patch available | GHSA-gq28-h5vg-8prx |
| — | org.springframework.security:spring-security-web (Maven) | before 5.2.9 | 5.2.9 | Patch available | GHSA-gq28-h5vg-8prx |
- Spring Security Vendor— Affected 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE Fixed in — No fix listed CNA
- org.springframework.security:spring-security-bom (Maven) Vendor— Affected 5.4.0 to before 5.4.4 Fixed in 5.4.4 Patch available GHSA-gq28-h5vg-8prx
- org.springframework.security:spring-security-bom (Maven) Vendor— Affected 5.3.0 to before 5.3.8 Fixed in 5.3.8 Patch available GHSA-gq28-h5vg-8prx
- org.springframework.security:spring-security-bom (Maven) Vendor— Affected before 5.2.9 Fixed in 5.2.9 Patch available GHSA-gq28-h5vg-8prx
- org.springframework.security:spring-security-web (Maven) Vendor— Affected 5.4.0 to before 5.4.4 Fixed in 5.4.4 Patch available GHSA-gq28-h5vg-8prx
- org.springframework.security:spring-security-web (Maven) Vendor— Affected 5.3.0 to before 5.3.8 Fixed in 5.3.8 Patch available GHSA-gq28-h5vg-8prx
- org.springframework.security:spring-security-web (Maven) Vendor— Affected before 5.2.9 Fixed in 5.2.9 Patch available GHSA-gq28-h5vg-8prx
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pivotal_software:spring_security:*:*:*:*:*:*:*:* | before 5.2.9; 5.3.0 to before 5.3.8 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* | 5.4.0 to before 5.4.4 | Vulnerable | VMware |
| cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* | 8.2.0 – 8.2.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:* | 6.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:* | 6.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* | 7.4.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.1.0:*:*:*:*:*:*:* | 20.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:11.2.0:*:*:*:*:*:*:* | 11.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:11.3.0:*:*:*:*:*:*:* | 11.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* | up to 8.0.25 | Vulnerable | Oracle |
- cpe:2.3:a:pivotal_software:spring_security:*:*:*:*:*:*:*:* Versions before 5.2.9; 5.3.0 to before 5.3.8 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* Versions 5.4.0 to before 5.4.4 Vulnerable ·VMware
- cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:* Versions 6.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.1.0:*:*:*:*:*:*:* Versions 20.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:11.2.0:*:*:*:*:*:*:* Versions 11.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:11.3.0:*:*:*:*:*:*:* Versions 11.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 8.0.25 Vulnerable ·Oracle
Remediation
- Fix · GHSA-gq28-h5vg-8prx org.springframework.security:spring-security-bom (Maven) Fixed in 5.4.4 Advisory →
- Fix · GHSA-gq28-h5vg-8prx org.springframework.security:spring-security-bom (Maven) Fixed in 5.3.8 Advisory →
- Fix · GHSA-gq28-h5vg-8prx org.springframework.security:spring-security-bom (Maven) Fixed in 5.2.9 Advisory →
- Fix · GHSA-gq28-h5vg-8prx org.springframework.security:spring-security-web (Maven) Fixed in 5.4.4 Advisory →
- Fix · GHSA-gq28-h5vg-8prx org.springframework.security:spring-security-web (Maven) Fixed in 5.3.8 Advisory →
- Fix · GHSA-gq28-h5vg-8prx org.springframework.security:spring-security-web (Maven) Fixed in 5.2.9 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 3 products
- Red Hat Fuse 7
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-22112
- 2026-10-03 Alias added: GHSA-gq28-h5vg-8prx
References
Patch 2
Advisory 4
Other 23
- [nifi-issues] 20210510 [GitHub] [nifi] exceptionfactory opened a new pull request #5066: NIFI-8502 Upgrade Spring Framework to 5.3.6
- [portals-pluto-dev] 20210623 [jira] [Closed] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.0 due to CVE-2021-22112
- [portals-pluto-dev] 20210623 [jira] [Updated] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.0 due to CVE-2021-22112
- [portals-pluto-scm] 20210623 [portals-pluto] branch master updated: PLUTO-786 Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.0 due to CVE-2021-22112
- [portals-pluto-dev] 20210714 [jira] [Updated] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119
- [portals-pluto-dev] 20210714 [jira] [Reopened] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119
- [portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119
- [portals-pluto-dev] 20210714 [jira] [Reopened] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.0 due to CVE-2021-22112
- [portals-pluto-dev] 20210714 [jira] [Comment Edited] (PLUTO-786) Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119
- [portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-786 Upgrade to version Spring Framework 5.3.7 and Spring Security 5.5.1 due to CVE-2021-22112 and CVE-2021-22119
- https://www.jenkins.io/security/advisory/2021-02-19
- https://lists.apache.org/thread.html/redbd004a503b3520ae5746c2ab5e93fd7da807a8c128e60d2002cd9b@%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/ra6389b1b82108a3b6bbcd22979f7665fd437c2a3408c9509a15a9ca1@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc@%3Cpluto-scm.portals.apache.org%3E
- https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r413e380088c427f56102968df89ef2f336473e1b56b7d4b3a571a378@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r37423ec7eea340e92a409452c35b649dce02fdc467f0b3f52086c177@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r2cb05e499807900ba23e539643eead9c5f0652fd271f223f89da1804@%3Cpluto-scm.portals.apache.org%3E
- https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14@%3Cpluto-dev.portals.apache.org%3E
- https://github.com/spring-projects/spring-security/releases/tag/5.4.4
- https://github.com/spring-projects/spring-security
Sources
- CVE-2021-22112 · CVE Program
- CVE-2021-22112 · NVD
- FIRST EPSS
- GHSA-gq28-h5vg-8prx · GitHub Advisory Database · CC BY 4.0
- CVE-2021-22112 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences