Authorization Rule Misconfiguration

2023-07-2102:37:55

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

authorization rule misconfiguration

spring-security-config

requestmatcher

abstractrequestmatcherregistry.java

validation

function

servlets

dispatcherservlet

vulnerability

spring mvc

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

0.001

Percentile

29.7%

JSON

spring-security-config is vulnerable to Authorization Rule Misconfiguration. The vulnerability exists due to the lack of validation in the RequestMatcher of AbstractRequestMatcherRegistry.java when the application uses the requestMatchers(String) function with multiple servlets, one of them being Spring MVC’s DispatcherServlet.