Skip to main content

Improper Access Control

CVE-2024-22234

High
7.4/10

Summary

In Spring Security, versions 6.1.x prior to 6.1.7, 6.2.x prior to 6.2.2, and 6.3.0-M1 an application is vulnerable to broken access control when it directly uses the "AuthenticationTrustResolver.isFullyAuthenticated(Authentication)" method. Specifically, an application is vulnerable if, the application uses "AuthenticationTrustResolver.isFullyAuthenticated(Authentication)" directly and a null authentication parameter is passed to it resulting in an erroneous true return value. An application is not vulnerable if any of the following is true, the application does not use "AuthenticationTrustResolver.isFullyAuthenticated(Authentication)" directly, the application does not pass null to "AuthenticationTrustResolver.isFullyAuthenticated", the application only uses "isFullyAuthenticated" via Method Security or HTTP Request Security.

  • HIGH
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-284 - Improper Access Control

Listed 5th in the 'OWASP Top Ten', improper (or broken) access control attacks are a fundamental type of vulnerability. This includes a broad range of design flaws that enable users to act outside of their intended permissions. They can use these privileges to gain access to restricted files and functionality such as accessing restricted information, falsifying records, destroying data, or executing commands.

References

Advisory Timeline

  • Published