GHSA-3295-h9qx-r82x
Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | >= 2.0.0, < 2.0.6 | 2.0.6 |
| Maven | org.springframework.security:spring-security-core | >= 3.0.0, < 3.0.4 | 3.0.4 |
| Maven | org.acegisecurity:acegi-security | >= 1.0.0, <= 1.0.7 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
References
External links from the advisory. They lead to third-party sites.