CVE-2024-22257

Data: 2024-03-21

Severity: High

CVSS Score: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Riferimenti:

• https://nvd.nist.gov/vuln/detail/CVE-2024-22257

• https://ossindex.sonatype.org/vulnerability/CVE-2024-22257

• https://github.com/advisories/GHSA-f3jh-qvm4-mg39

Libreria: org.springframework.security:* < 5.8.11

Descrizione

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

GovWay

Versione affette: <= 3.3.14

Risoluzione: prima versione in rilascio