~ / search / GHSA-hmqf-wpq9-jq83

GHSA-hmqf-wpq9-jq83

Spring Security Missing Authorization vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-38810

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework.security:spring-security-core >= 6.3.0, < 6.3.2 6.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.

References

External links from the advisory. They lead to third-party sites.