CVSS 3.1
8.2 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NCVE-2024-22257
High (8.2). EPSS 1.0% chance of exploitation in the next 30 days. Fixed in org.springframework.security:spring-security-core 5.7.12, 5.8.11, 6.1.8.
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to
5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8,
versions 6.2.x prior to 6.2.3, an application is possible vulnerable to
broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-f3jh-qvm4-mg39 | Maven | org.springframework.security:spring-security-core | <5.7.12 | 5.7.12 |
| GHSA-f3jh-qvm4-mg39 | Maven | org.springframework.security:spring-security-core | >=5.8.0 <5.8.11 | 5.8.11 |
| GHSA-f3jh-qvm4-mg39 | Maven | org.springframework.security:spring-security-core | >=6.0.0 <6.1.8 | 6.1.8 |
| GHSA-f3jh-qvm4-mg39 | Maven | org.springframework.security:spring-security-core | >=6.2.0 <6.2.3 | 6.2.3 |