Missing authorization in Spring Security
Priority MEDIUM 43CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Partial Red Hat: 3 fixed, 8 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.
Summary
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00956 61st percentileScored 2026-11-07
Fix Partial org.springframework.security:spring-security-core (Maven): 5.7.12, 5.8.11, 6.1.8 +1Red Hat: 3 advisoriesRed Hat: 3 fixed, 8 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| N/A | Spring Security | 6.2.0 to 6.2.2, 6.1.0 to 6.1.7, 6.0.0 to 6.0.9, 5.8.0 to 5.8.10, 5.7.0 to 5.7.11 | — | No fix listed | CNA |
| — | org.springframework.security:spring-security-core (Maven) | before 5.7.12 | 5.7.12 | Patch available | GHSA-f3jh-qvm4-mg39 |
| — | org.springframework.security:spring-security-core (Maven) | 5.8.0 to before 5.8.11 | 5.8.11 | Patch available | GHSA-f3jh-qvm4-mg39 |
| — | org.springframework.security:spring-security-core (Maven) | 6.0.0 to before 6.1.8 | 6.1.8 | Patch available | GHSA-f3jh-qvm4-mg39 |
| — | org.springframework.security:spring-security-core (Maven) | 6.2.0 to before 6.2.3 | 6.2.3 | Patch available | GHSA-f3jh-qvm4-mg39 |
- Spring Security VendorN/A Affected 6.2.0 to 6.2.2, 6.1.0 to 6.1.7, 6.0.0 to 6.0.9, 5.8.0 to 5.8.10, 5.7.0 to 5.7.11 Fixed in — No fix listed CNA
- org.springframework.security:spring-security-core (Maven) Vendor— Affected before 5.7.12 Fixed in 5.7.12 Patch available GHSA-f3jh-qvm4-mg39
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 5.8.0 to before 5.8.11 Fixed in 5.8.11 Patch available GHSA-f3jh-qvm4-mg39
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 6.0.0 to before 6.1.8 Fixed in 6.1.8 Patch available GHSA-f3jh-qvm4-mg39
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 6.2.0 to before 6.2.3 Fixed in 6.2.3 Patch available GHSA-f3jh-qvm4-mg39
CPE names CISA-ADP · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pivotal_software:spring_security:5.7.0:*:*:*:*:*:*:* | 5.7.0 | — | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:spring_security:5.8.0:*:*:*:*:*:*:* | 5.8.0 | — | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:spring_security:6.0.0:*:*:*:*:*:*:* | 6.0.0 | — | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:spring_security:6.1.0:*:*:*:*:*:*:* | 6.1.0 | — | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:spring_security:6.2.0:*:*:*:*:*:*:* | 6.2.0 | — | Spring by Pivotal |
- cpe:2.3:a:pivotal_software:spring_security:5.7.0:*:*:*:*:*:*:* Versions 5.7.0 — ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:spring_security:5.8.0:*:*:*:*:*:*:* Versions 5.8.0 — ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:spring_security:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 — ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:spring_security:6.1.0:*:*:*:*:*:*:* Versions 6.1.0 — ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:spring_security:6.2.0:*:*:*:*:*:*:* Versions 6.2.0 — ·Spring by Pivotal
Remediation
- Fix · GHSA-f3jh-qvm4-mg39 org.springframework.security:spring-security-core (Maven) Fixed in 5.7.12 Advisory →
- Fix · GHSA-f3jh-qvm4-mg39 org.springframework.security:spring-security-core (Maven) Fixed in 5.8.11 Advisory →
- Fix · GHSA-f3jh-qvm4-mg39 org.springframework.security:spring-security-core (Maven) Fixed in 6.1.8 Advisory →
- Fix · GHSA-f3jh-qvm4-mg39 org.springframework.security:spring-security-core (Maven) Fixed in 6.2.3 Advisory →
Red Hat 3 advisories
- RHSA-2024:4884 Released 2024-07-25 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.4.1 for Spring Boot security update.
- Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
- RHSA-2024:3708 Released 2024-06-06 · Red Hat rating ImportantRed Hat Build of Apache Camel 3.20.6 for Spring Boot security update.
- Red Hat build of Apache Camel 3.20.6 for Spring Boot
- RHSA-2024:3354 Released 2024-05-23 · Red Hat rating ImportantRed Hat Fuse 7.13.0 release and security update
- Red Hat Fuse 7.13.0
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix yet |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet |
| Red Hat Fuse 7.13.0 | Fixed | RHSA-2024:3354 |
| Red Hat build of Apache Camel 3.20.6 for Spring Boot | Fixed | RHSA-2024:3708 |
| Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 | Fixed | RHSA-2024:4884 |
Not affected: 7 products
- A-MQ Clients 2
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Red Hat Integration Camel K 1
- Red Hat JBoss Data Grid 7
- Red Hat Single Sign-On 7
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2024-22257
- 2026-10-03 Alias added: GHSA-f3jh-qvm4-mg39
References
Other 5
- https://spring.io/security/cve-2024-22257
- https://security.netapp.com/advisory/ntap-20240419-0005/
- https://github.com/spring-projects/spring-security/commit/5a7f12f1a9fdb4edaab6f61495f1d781a7273b61
- https://github.com/spring-projects/spring-security
- https://security.netapp.com/advisory/ntap-20240419-0005
Sources
- CVE-2024-22257 · CVE Program
- CVE-2024-22257 · NVD
- FIRST EPSS
- GHSA-f3jh-qvm4-mg39 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-22257 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences