Lucene search

Veracode Vulnerability DatabaseVERACODE:29909

HistoryApr 06, 2021 - 3:21 a.m.

Privilege Escalation

2021-04-0603:21:24

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

65.8%

JSON

spring-security-web is vulnerable to privilege escalation. The SecurityContext is not saved if it has been changed more than once in a single request, allowing a malicious user to run with elevated privileges in a small portion of the application, and subsequently may extend those privileges to the rest of the application.

CPENameOperatorVersion
spring-security-weble5.1.13.RELEASE
spring-security-weble5.4.3
spring-security-weble5.3.7.RELEASE
spring-security-weble4.2.20.RELEASE
spring-security-weble5.2.8.RELEASE
spring-security-weble3.2.10.RELEASE
spring-security-weble5.1.13.RELEASE
spring-security-weble5.4.3
spring-security-weble5.3.7.RELEASE
spring-security-weble4.2.20.RELEASE

Name	Operator	Version
spring-security-web	le	5.1.13.RELEASE
spring-security-web	le	5.4.3
spring-security-web	le	5.3.7.RELEASE
spring-security-web	le	4.2.20.RELEASE
spring-security-web	le	5.2.8.RELEASE
spring-security-web	le	3.2.10.RELEASE
spring-security-web	le	5.1.13.RELEASE
spring-security-web	le	5.4.3
spring-security-web	le	5.3.7.RELEASE
spring-security-web	le	4.2.20.RELEASE

Rows per page:

1-10 of 121

References

www.openwall.com/lists/oss-security/2021/02/19/7

github.com/spring-projects/spring-security/commit/c72a6fac04853912a4b7caad5f0500f2aace5a79

github.com/spring-projects/spring-security/compare/996ccc08a47a1bba30e7595fe27ca6dcfc1ea5b5...419839d05c2cf42e13890818c57a729c53724f47

github.com/spring-projects/spring-security/compare/f60daa51529c8330219528ec2ea99446da0bbc78...e2121532a2f86a379c3cd6f6e4bf7bd014311a9d

github.com/spring-projects/spring-security/releases/tag/5.4.4

lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14@%3Cpluto-dev.portals.apache.org%3E

lists.apache.org/thread.html/r2cb05e499807900ba23e539643eead9c5f0652fd271f223f89da1804@%3Cpluto-scm.portals.apache.org%3E

lists.apache.org/thread.html/r37423ec7eea340e92a409452c35b649dce02fdc467f0b3f52086c177@%3Cpluto-dev.portals.apache.org%3E

lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3@%3Cpluto-dev.portals.apache.org%3E

lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde@%3Cpluto-dev.portals.apache.org%3E

lists.apache.org/thread.html/r413e380088c427f56102968df89ef2f336473e1b56b7d4b3a571a378@%3Cpluto-dev.portals.apache.org%3E

lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f@%3Cpluto-dev.portals.apache.org%3E

lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc@%3Cpluto-scm.portals.apache.org%3E

lists.apache.org/thread.html/ra6389b1b82108a3b6bbcd22979f7665fd437c2a3408c9509a15a9ca1@%3Cpluto-dev.portals.apache.org%3E

lists.apache.org/thread.html/redbd004a503b3520ae5746c2ab5e93fd7da807a8c128e60d2002cd9b@%3Cissues.nifi.apache.org%3E

tanzu.vmware.com/security/cve-2021-22112

www.oracle.com//security-alerts/cpujul2021.html

www.oracle.com/security-alerts/cpuApr2021.html

www.oracle.com/security-alerts/cpuoct2021.html

0.003 Low

EPSS

Percentile

65.8%

JSON

Related for VERACODE:29909