PT-2017-8646 · Spring · Spring Mvc+2

Clément Notin · Published 2017-05-25 · Updated 2022-04-11 · CVE-2016-5007

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spring Security versions 3.2.x through 4.1.0 Spring Framework versions 3.2.x through 4.2.x

Description The issue arises from differences in the strictness of URL pattern matching mechanisms between Spring Security and the Spring Framework, which can lead to certain paths not being recognized as protected even though they are mapped to Spring MVC controllers that should be protected. This problem is further complicated by the richer features of the Spring Framework regarding pattern matching and the ease of customization of pattern matching in both Spring Security and the Spring Framework.

Recommendations For Spring Security versions 3.2.x through 4.1.0, consider updating the configuration to align the pattern matching mechanisms with those of the Spring Framework to ensure consistent protection of paths. For Spring Framework versions 3.2.x through 4.2.x, review and adjust the URL pattern mappings to ensure that all paths intended to be protected are correctly recognized by Spring Security. As a temporary workaround, consider restricting access to sensitive controllers and paths until a more comprehensive solution can be implemented.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-5007

GHSA-8CRV-49FR-2H6J

OESA-2021-1416

Affected Products

Spring Framework

Spring Mvc

Spring Security

References · 19

• https://osv.dev/vulnerability/DEBIAN-CVE-2016-5007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5007 · Security Note
• https://osv.dev/vulnerability/CVE-2016-5007 · Vendor Advisory
• https://pivotal.io/security/cve-2016-5007 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-5007 · Security Note
• https://ubuntu.com/security/CVE-2016-5007 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8crv-49fr-2h6j · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-5007 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5007 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1416 · Vendor Advisory
• https://github.com/spring-projects/spring-framework/commit/a30ab30e4e9ae021fdda04e9abfc228476b846b5 · Note
• https://github.com/spring-projects/spring-security/issues/3964 · Note
• https://github.com/spring-projects/spring-security/commit/e4c13e3c0ee7f06f59d3b43ca6734215ad7d8974 · Note
• http://securityfocus.com/bid/91687 · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1416 · Note