PT-2024-1840 · Unknown · Spring Security
Rogério Sorroche
·
Published
2024-02-19
·
Updated
2026-05-21
·
CVE-2024-22234
CVSS v3.1
7.4
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Spring Security versions 6.1.x through 6.1.6
Spring Security versions 6.2.x through 6.2.1
Description
The issue is related to broken access control in Spring Security when the
AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method is used directly. Specifically, an application is vulnerable if it uses this method directly and a null authentication parameter is passed, resulting in an erroneous true return value. This could allow a remote attacker to impact the integrity and confidentiality of protected information.Recommendations
For Spring Security versions 6.1.x through 6.1.6, update to version 6.1.7 or later to resolve the issue.
For Spring Security versions 6.2.x through 6.2.1, update to version 6.2.2 or later to resolve the issue.
As a temporary workaround, consider avoiding the direct use of the
AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method or ensure that a null authentication parameter is not passed to it.
Alternatively, use the isFullyAuthenticated method via Method Security or HTTP Request Security to minimize the risk of exploitation.Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Spring Security