PT-2017-5875 · Spring · Spring Security

David Ohsie · Published 2017-05-25 · Updated 2021-06-08 · CVE-2014-3527

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Spring Security versions 3.1 through 3.2.4

Description: A malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated, due to the proxy ticket authentication using information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request. This means access control restrictions on which CAS services can authenticate to one another can be bypassed. If users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service, then there is no impact to users.

Recommendations: Users of version 3.1.x should upgrade to 3.1.7 or later Users of version 3.2.x should upgrade to 3.2.5 or later

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-3527

GHSA-WMV4-5W76-VP9G

Affected Products

Spring Security

References · 6

• https://osv.dev/vulnerability/GHSA-wmv4-5w76-vp9g · Vendor Advisory
• https://pivotal.io/security/cve-2014-3527 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3527 · Security Note
• https://github.com/spring-projects/spring-security · Note
• https://github.com/spring-projects/spring-security/commit/934937d9c1dc20c396b96c08310b72cfa627acb · Note
• https://github.com/spring-projects/spring-security/issues/2907 · Note