CVE-2012-5055
Exposure of Sensitive Information to an Unauthorized Actor in Spring Security
DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
Exploit likelihood
What each source reports
NVD Score used
DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
- Record
CVE-2012-5055- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
- Record
CVE-2012-5055- Updated
- 2026-11-02
EUVDEUVD-2022-2109 No score
DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
- Record
EUVD-2022-2109- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3533-rvpc-6x56 No score
Exposure of Sensitive Information to an Unauthorized Actor in Spring Security
DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
- Record
GHSA-3533-rvpc-6x56- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-3533-rvpc-6x56 No score
Exposure of Sensitive Information to an Unauthorized Actor in Spring Security
DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
- Record
GHSA-3533-rvpc-6x56- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-coreMaven |
before 2.0.8 | 2.0.8 |
org.springframework.security:spring-security-coreMaven |
3.0.0 up to 3.0.8 | 3.0.8 |
org.springframework.security:spring-security-coreMaven |
3.1.0 up to 3.1.3 | 3.1.3 |
org.springframework.security:spring-security-coreMaven |
before 2.0.8, plus listed versions 2.0.02.0.12.0.22.0.32.0.42.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE |
2.0.8 |
org.springframework.security:spring-security-coreMaven |
3.0.0 up to 3.0.8, plus listed versions 3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE |
3.0.8 |
org.springframework.security:spring-security-coreMaven |
3.1.0 up to 3.1.3, plus listed versions 3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE |
3.1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-5055 is a medium vulnerability (CVSS 5.0) in Vmware Springsource Spring Security, published December 5, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.95%, the 80th percentile. Fixed in org.springframework.security:spring-security-core 2.0.8.