Read the docs
TI-2024-14824 Aliases CVE-2024-22234GHSA-w3w6-26f2-p474

CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated

Priority LOW 36CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 3 fixed, 8 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.

Summary

In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. Specifically, an application is vulnerable if: * The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value. An application is not vulnerable if any of the following is true: * The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly. * The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated * The application only uses isFullyAuthenticated via Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00682 52nd percentileScored 2026-11-07
Fix Partial Spring Security (Spring): 6.1.7, 6.2.2org.springframework.security:spring-security-core (Maven): 6.1.7, 6.2.2Red Hat: 3 advisoriesRed Hat: 3 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareSpring Security6.1.x to before 6.1.7; 6.2.x to before 6.2.26.1.7, 6.2.2Patch availableCNA
—org.springframework.security:spring-security-core (Maven)6.1.0 to before 6.1.76.1.7Patch availableGHSA-w3w6-26f2-p474
—org.springframework.security:spring-security-core (Maven)6.2.0 to before 6.2.26.2.2Patch availableGHSA-w3w6-26f2-p474
  • Spring Security VendorVMware Affected 6.1.x to before 6.1.7; 6.2.x to before 6.2.2 Fixed in 6.1.7, 6.2.2 Patch available CNA
  • org.springframework.security:spring-security-core (Maven) Vendor— Affected 6.1.0 to before 6.1.7 Fixed in 6.1.7 Patch available GHSA-w3w6-26f2-p474
  • org.springframework.security:spring-security-core (Maven) Vendor— Affected 6.2.0 to before 6.2.2 Fixed in 6.2.2 Patch available GHSA-w3w6-26f2-p474

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*6.1.0 to before 6.1.7; 6.2.0 to before 6.2.2VulnerableVMware
  • cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* Versions 6.1.0 to before 6.1.7; 6.2.0 to before 6.2.2 Vulnerable ·VMware

Remediation

  • Fix · CNA Spring Security (Spring) Fixed in 6.1.7, 6.2.2
  • Fix · GHSA-w3w6-26f2-p474 org.springframework.security:spring-security-core (Maven) Fixed in 6.1.7 Advisory →
  • Fix · GHSA-w3w6-26f2-p474 org.springframework.security:spring-security-core (Maven) Fixed in 6.2.2 Advisory →

Red Hat 3 advisories

  • RHSA-2024:6667 Released 2024-09-12 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.16.0 release
    • Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8, devspaces/configbump-rhel8, devspaces/dashboard-rhel8 +10
  • RHSA-2024:4884 Released 2024-07-25 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.4.1 for Spring Boot security update.
    • Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
  • RHSA-2024:3550 Released 2024-06-03 · Red Hat rating Important
    HawtIO 4.0.0 for Red Hat build of Apache Camel 4 Release and security update.
    • HawtIO 4.0.0 for Red Hat build of Apache Camel 4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix planned: Will not fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet
HawtIO 4.0.0 for Red Hat build of Apache Camel 4Fixed RHSA-2024:3550
Red Hat OpenShift Dev Spaces 3Fixed RHSA-2024:6667
Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2Fixed RHSA-2024:4884
Not affected: 17 products
  • A-MQ Clients 2
  • Red Hat Build of Keycloak
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces 3
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat build of Quarkus
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22234
  2. 2026-10-03 Alias added: GHSA-w3w6-26f2-p474
  3. 2026-11-05 Affected versions changed · Red Hat

References

Advisory 3

Other 3

  • TI-2023-16900 Improper access control in Spring Security CVSS 3.1CRITICAL 9.8
  • TI-2022-13611 Authorization bypass in Spring by VMware CVSS 3.1CRITICAL 9.8
  • TI-2022-07154 Incorrect authorization in Spring Security CVSS 3.1CRITICAL 9.8
  • TI-2026-42404 Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces CVSS 3.1CRITICAL 9.4
  • TI-2026-18257 Under Some Conditions Spring Security HTTP Headers Are not Written CVSS 3.1CRITICAL 9.1
  • TI-2014-02853 Improper authentication in Pivotal Spring Security CVSS 3.0CRITICAL 9.8
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences