PT-2025-37861 · Vmware+1 · Spring Framework+2

Published 2025-09-15 · Updated 2026-05-07 · CVE-2025-41248

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spring Framework (affected versions not specified)

Description The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type. This can lead to an authorization bypass.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-289

CWE-863

Related Identifiers

BDU:2025-11287

CVE-2025-41248

GHSA-8V5Q-RHF3-JPHM

Affected Products

Bitbucket

Confluence

Spring Framework

References · 31

• https://bdu.fstec.ru/vul/2025-11287 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-41248 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-41248 · Security Note
• https://osv.dev/vulnerability/GHSA-8v5q-rhf3-jphm · Vendor Advisory
• https://github.com/spring-projects/spring-security · Note
• https://github.com/spring-projects/spring-security/releases/tag/6.4.10 · Note
• https://github.com/spring-projects/spring-security/releases/tag/6.5.4 · Note
• https://github.com/spring-projects/spring-security/issues/17899 · Note
• https://github.com/spring-projects/spring-security/commit/e5694ac7b5e4394b920c6cab48b7bfbd871f84bd · Note
• https://github.com/spring-projects/spring-security/commit/d0f93fa6d8338149943ae640c53db07de827867f · Note
• https://github.com/spring-projects/spring-security/issues/17898 · Note
• https://twitter.com/sam_brannen/status/1967671170498719778 · Twitter Post
• https://t.me/cveNotify/135594 · Telegram Post
• https://twitter.com/dailycve/status/1968055560378659075 · Twitter Post
• https://jira.atlassian.com/browse/CONFSERVER-101485 · Note