PT-2024-2215 · Atlassian+1 · Bitbucket Data Center/Server+6

Pwnull · Published 2024-03-11 · Updated 2026-05-18 · CVE-2024-22257

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.7.x prior to 5.7.12 Spring Security versions 5.8.x prior to 5.8.11 Spring Security versions 6.0.x prior to 6.0.9 Spring Security versions 6.1.x prior to 6.1.8 Spring Security versions 6.2.x prior to 6.2.3 Bitbucket Data Center and Server versions 8.0.0 through 8.19.0 Bamboo Data Center and Server versions 8.2.1, 9.0.0, 9.1.0, 9.2.1, 9.3.0, 9.4.0, 9.5.0, and 9.6.0

Description The issue is related to broken access control in Spring Security when the AuthenticatedVoter#vote function is used directly with a null Authentication parameter. This could allow an unauthenticated attacker to expose assets in the environment that are susceptible to exploitation, with a high impact on confidentiality and low impact on integrity. Approximately 8,638 results have been found, mainly distributed in the United States and Canada.

Recommendations For Spring Security versions 5.7.x prior to 5.7.12, upgrade to version 5.7.12 or later. For Spring Security versions 5.8.x prior to 5.8.11, upgrade to version 5.8.11 or later. For Spring Security versions 6.0.x prior to 6.0.9, upgrade to version 6.0.9 or later. For Spring Security versions 6.1.x prior to 6.1.8, upgrade to version 6.1.8 or later. For Spring Security versions 6.2.x prior to 6.2.3, upgrade to version 6.2.3 or later. For Bitbucket Data Center and Server, upgrade to version 8.19.1 or later, or one of the specified supported fixed versions. For Bamboo Data Center and Server, upgrade to version 9.6.1 or later, or one of the specified supported fixed versions. As a temporary workaround, consider avoiding the direct use of AuthenticatedVoter#vote with a null Authentication parameter until a patch is available.

Fix

Improper Access Control

Missing Authorization

Improper Authentication

Weakness Enumeration

CWE-284

CWE-862

CWE-287

Related Identifiers

BDU:2024-02143

CLEANSTART-2026-KP10590

CVE-2024-22257

GHSA-F3JH-QVM4-MG39

Affected Products

Bamboo

Bamboo Data Center/Server

Bitbucket

Bitbucket Data Center/Server

Confluence

Jira

Spring Security

References · 46

• https://nvd.nist.gov/vuln/detail/CVE-2026-3505 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-5588 · Security Note
• https://osv.dev/vulnerability/GHSA-f3jh-qvm4-mg39 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2024-22257 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22257 · Security Note
• https://bdu.fstec.ru/vul/2024-02143 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-22257 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-7962 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38821 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47561 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-KP10590 · Vendor Advisory
• https://github.com/spring-projects/spring-security · Note
• https://github.com/spring-projects/spring-security/issues/14715 · Note
• https://github.com/spring-projects/spring-security/commit/5a7f12f1a9fdb4edaab6f61495f1d781a7273b61 · Note
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KP10590.json · Note