CVE-2024-22257
Erroneous authentication pass in Spring Security
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
- Record
CVE-2024-22257- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2024-0908
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
- Record
EUVD-2024-0908- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f3jh-qvm4-mg39
Erroneous authentication pass in Spring Security
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
Specifically, an application is vulnerable if:
The application uses AuthenticatedVoter directly and a null authentication parameter is passed to it resulting in an erroneous true return value.
An application is not vulnerable if any of the following is true:
- The application does not use AuthenticatedVoter#vote directly.
- The application does not pass null to AuthenticatedVoter#vote.
Note that AuthenticatedVoter is deprecated since 5.8, use implementations of AuthorizationManager as a replacement.
- Record
GHSA-f3jh-qvm4-mg39- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-287, CWE-862
- Updated
- 2026-11-02
NVD
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
- Record
CVE-2024-22257- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-f3jh-qvm4-mg39
Erroneous authentication pass in Spring Security
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
Specifically, an application is vulnerable if:
The application uses AuthenticatedVoter directly and a null authentication parameter is passed to it resulting in an erroneous true return value.
An application is not vulnerable if any of the following is true:
- The application does not use AuthenticatedVoter#vote directly.
- The application does not pass null to AuthenticatedVoter#vote.
Note that AuthenticatedVoter is deprecated since 5.8, use implementations of AuthorizationManager as a replacement.
- Record
GHSA-f3jh-qvm4-mg39- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-287, CWE-862
- Updated
- 2026-11-02
OSVRHLW-2026-630128d9882e951f
Lightwell Security Advisory: spring-security-core 5.7.11.rhlw-00006
Red Hat Lightwell has released org.springframework.security:spring-security-core 5.7.11.rhlw-00006 with backported fixes for CVE-2024-22257, CVE-2024-38827, and CVE-2026-22746.
CVE-2026-22746: User Attribute Enumeration when Using DaoAuthenticationProvider
This patched artifact is a drop-in replacement for org.springframework.security:spring-security-core 5.7.11 from Maven Central.
- Record
RHLW-2026-630128d9882e951f- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 14 moreShow less
OSVROOT-APP-MAVEN-CVE-2024-22257
CVE-2024-22257 in org.springframework.security:spring-security-core - Patched by Root
Root has patched CVE-2024-22257 in the org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2024-22257- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2024-1727308812 No score
TuxCare security update for org.springframework.security:spring-security-core (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-core to address 1 CVE. Fixed in 5.7.11.tuxcare.
- Record
CLSA-2024-1727308812- Updated
- 2026-11-02
OSVCLSA-2026-1768349319 No score
TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 6.1.6-tuxcare.1.
- Record
CLSA-2026-1768349319- Updated
- 2026-11-02
OSVCLSA-2026-1773015254 No score
TuxCare security update for org.springframework.security (5 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 5 CVEs. Fixed in 4.2.20.RELEASE-tuxcare.1.
- Record
CLSA-2026-1773015254- Updated
- 2026-11-02
OSVCLSA-2026-1775435426 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 3 org.springframework.security packages to address 6 CVEs. Fixed in 6.2.2-tuxcare.1.
- Record
CLSA-2026-1775435426- Updated
- 2026-11-02
OSVCLSA-2026-1775694713 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 4.2.12.RELEASE-tuxcare.1.
- Record
CLSA-2026-1775694713- Updated
- 2026-11-02
OSVCLSA-2026-1776126833 No score
TuxCare security update for org.springframework.security (5 CVEs)
TuxCare rebuilt 3 org.springframework.security packages to address 5 CVEs. Fixed in 5.6.10-tuxcare.1.
- Record
CLSA-2026-1776126833- Updated
- 2026-11-02
OSVCLSA-2026-1785814692 No score
TuxCare security update for org.springframework.security (3 CVEs)
TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.0.8-tuxcare.1.
- Record
CLSA-2026-1785814692- Updated
- 2026-11-02
OSVCLSA-2026-1791380003 No score
TuxCare security update for org.springframework.security (11 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.7.7-tuxcare.1.
- Record
CLSA-2026-1791380003- Updated
- 2026-11-02
OSVCLSA-2026-1791391633 No score
TuxCare security update for org.springframework.security (11 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.5.8-tuxcare.1.
- Record
CLSA-2026-1791391633- Updated
- 2026-11-02
OSVCLSA-2026-1792079446 No score
TuxCare security update for org.springframework.security (15 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.
- Record
CLSA-2026-1792079446- Updated
- 2026-11-02
OSVCLSA-2026-1792587913 No score
TuxCare security update for org.acegisecurity (2 CVEs)
TuxCare rebuilt 12 org.acegisecurity packages to address 2 CVEs. Fixed in 1.0.7-tuxcare.1.
- Record
CLSA-2026-1792587913- Updated
- 2026-11-02
OSVCLSA-2026-1792588191 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 3.2.8.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792588191- Updated
- 2026-11-02
OSVRHLW-2026-779e7aa7bc83a4c5 No score
Lightwell Security Advisory: spring-security-aspects 5.7.11.rhlw-00006
Red Hat Lightwell has released org.springframework.security:spring-security-aspects 5.7.11.rhlw-00006 with a backported security fix.
This patched artifact is a drop-in replacement for org.springframework.security:spring-security-aspects 5.7.11 from Maven Central.
- Record
RHLW-2026-779e7aa7bc83a4c5- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-coreMaven |
before 5.7.12 | 5.7.12 |
org.springframework.security:spring-security-coreMaven |
5.8.0 up to 5.8.11 | 5.8.11 |
org.springframework.security:spring-security-coreMaven |
6.0.0 up to 6.1.8 | 6.1.8 |
org.springframework.security:spring-security-coreMaven |
6.2.0 up to 6.2.3 | 6.2.3 |
org.springframework.security:spring-security-coreTuxCare:Maven |
5.7.11 up to 5.7.11.tuxcare | 5.7.11.tuxcare |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 4 CVEs |
6.1.6 up to 6.1.6-tuxcare.1 | 6.1.6-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 4 CVEs |
6.1.6 up to 6.1.6-tuxcare.1 | 6.1.6-tuxcare.1 |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 5 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1 | 4.2.20.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 5 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1 | 4.2.20.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 5 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1 | 4.2.20.RELEASE-tuxcare.1 |
Show 53 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 5 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1 | 4.2.20.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 6 CVEs |
6.2.2 up to 6.2.2-tuxcare.1 | 6.2.2-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 6 CVEs |
6.2.2 up to 6.2.2-tuxcare.1 | 6.2.2-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 6 CVEs |
6.2.2 up to 6.2.2-tuxcare.1 | 6.2.2-tuxcare.1 |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-casTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 5 CVEs |
5.6.10 up to 5.6.10-tuxcare.1 | 5.6.10-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 5 CVEs |
5.6.10 up to 5.6.10-tuxcare.1 | 5.6.10-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 5 CVEs |
5.6.10 up to 5.6.10-tuxcare.1 | 5.6.10-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 3 CVEs |
6.0.8 up to 6.0.8-tuxcare.1 | 6.0.8-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 3 CVEs |
6.0.8 up to 6.0.8-tuxcare.1 | 6.0.8-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 3 CVEs |
6.0.8 up to 6.0.8-tuxcare.1 | 6.0.8-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.acegisecurity:acegi-securityTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-adaptersTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-casTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-catalinaTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-jbossTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-jettyTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-parentTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-resinTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-samplesTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-samples-contactsTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-samples-tutorialTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-tigerTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-casTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreMaven |
before 5.7.12, plus listed versions 2.0.02.0.12.0.22.0.32.0.4 Show 45 moreShow less2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE |
5.7.12 |
org.springframework.security:spring-security-coreMaven |
5.8.0 up to 5.8.11, plus listed versions 5.8.15.8.105.8.25.8.35.8.4 Show 5 moreShow less5.8.55.8.65.8.75.8.85.8.9 |
5.8.11 |
org.springframework.security:spring-security-coreMaven |
6.0.0 up to 6.1.8, plus listed versions 6.0.16.0.26.0.36.0.46.0.5 Show 11 moreShow less6.0.66.0.76.0.86.1.06.1.16.1.26.1.36.1.46.1.56.1.66.1.7 |
6.1.8 |
org.springframework.security:spring-security-coreMaven |
6.2.0 up to 6.2.3, plus listed versions 6.2.16.2.2 |
6.2.3 |
org.springframework.security:spring-security-coreRed Hat Lightwell:Maven From an advisory covering 3 CVEs |
before 5.7.11.rhlw-00006, plus listed versions 2.0.02.0.12.0.22.0.32.0.4 Show 45 moreShow less2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE |
5.7.11.rhlw-00006 |
org.springframework.security:spring-security-aspectsRed Hat Lightwell:Maven |
before 5.7.11.rhlw-00006, plus listed versions 3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE Show 45 moreShow less3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE4.2.10.RELEASE4.2.11.RELEASE4.2.12.RELEASE4.2.13.RELEASE4.2.14.RELEASE4.2.15.RELEASE4.2.16.RELEASE4.2.17.RELEASE4.2.18.RELEASE4.2.19.RELEASE4.2.2.RELEASE4.2.20.RELEASE4.2.3.RELEASE4.2.4.RELEASE |
5.7.11.rhlw-00006 |
org.springframework.security:spring-security-coreRoot:Maven |
before 5.7.3-aikido.2 | 5.7.3-aikido.25.7.1-aikido.36.1.3-aikido.56.2.0-aikido.25.7.3-aikido.35.7.5-aikido.15.7.11-aikido.16.2.0-aikido.35.7.3-aikido.46.2.0-aikido.46.1.3-aikido.66.1.3-aikido.76.2.0-aikido.55.7.1-aikido.45.7.3-aikido.55.7.1-aikido.5 |
io.root.org.springframework.security:spring-security-coreRoot:Maven |
before 6.1.3-root.io.1 | 6.1.3-root.io.16.1.3-root.io.26.1.3-root.io.46.2.0-root.io.15.7.1-root.io.15.7.3-root.io.15.7.1-root.io.25.7.3-root.io.25.7.1-root.io.36.1.3-root.io.56.2.0-root.io.25.7.3-root.io.35.7.5-root.io.15.7.11-root.io.16.2.0-root.io.35.7.3-root.io.46.2.0-root.io.46.1.3-root.io.66.1.3-root.io.76.2.0-root.io.55.7.1-root.io.45.7.3-root.io.55.7.1-root.io.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-22257 is a high vulnerability (CVSS 8.2) in Pivotal Software Spring Security, published March 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in org.springframework.security:spring-security-core 5.7.12.
References
spring.io/security/cve-2024-22257
security.netapp.com/advisory/ntap-20240419-0005
github.com/dependency-check/DependencyCheck/issues/8642
nvd.nist.gov/vuln/detail/CVE-2024-22257
Left out here: 373 versions. The JSON record has them.