Authentication Bypass Via Null Authentication

2019-06-2709:28:20

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

35.4%

JSON

spring-security is vulnerable to authentication bypass. The cause of vulnerability is due to the use of PlaintextPasswordEncoder, validating the authentication of a user if a null encoded password is entered.

CPENameOperatorVersion
spring-security-corele4.2.12.RELEASE
spring-security-corele4.1.5.RELEASE
spring-security-corele3.2.10.RELEASE
spring-security-configle4.2.12.RELEASE
spring-security-configle4.1.5.RELEASE
spring-security-configle3.2.10.RELEASE

Name	Operator	Version
spring-security-core	le	4.2.12.RELEASE
spring-security-core	le	4.1.5.RELEASE
spring-security-core	le	3.2.10.RELEASE
spring-security-config	le	4.2.12.RELEASE
spring-security-config	le	4.1.5.RELEASE
spring-security-config	le	3.2.10.RELEASE