Skip to main content

Missing Authorization in org.acegisecurity:acegi-security

CVE-2024-22257

  • org.acegisecurity:acegi-security
  • org.springframework.security:spring-security-core
High
8.2/10

Summary

In Spring Security versions through 5.7.11, 5.8.0-M1 through 5.8.10, 6.0.0-M1 through 6.0.8, 6.1.0-M1 through 6.1.7, 6.2.0-M1 through 6.2.2, and 6.3.0-M1 through 6.3.0-M2, an application is possibly vulnerable to broken access control when it directly uses the "AuthenticatedVoter#vote" passing a "null" Authentication parameter.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-862 - Missing Authorization

The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.

References

Advisory Timeline

  • Published