CVE-2019-11272
PlaintextPasswordEncoder authenticates encoded passwords that are null
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".
- Record
CVE-2019-11272- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287, CWE-522
- Updated
- 2026-11-02
CVE List No score
PlaintextPasswordEncoder authenticates encoded passwords that are null
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".
- Record
CVE-2019-11272- Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2019-0562 No score
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".
- Record
EUVD-2019-0562- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v33x-prhc-gph5
Insufficiently Protected Credentials and Improper Authentication in Spring Security
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of ?null?.
- Record
GHSA-v33x-prhc-gph5- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-287, CWE-522
- Updated
- 2026-11-02
OSV
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".
- Record
CVE-2019-11272- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVGHSA-v33x-prhc-gph5
Insufficiently Protected Credentials and Improper Authentication in Spring Security
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of ?null?.
- Record
GHSA-v33x-prhc-gph5- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-287, CWE-522
- Updated
- 2026-11-02
OSVCLSA-2026-1775694713 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 4.2.12.RELEASE-tuxcare.1.
- Record
CLSA-2026-1775694713- Updated
- 2026-11-02
OSVCLSA-2026-1792587913 No score
TuxCare security update for org.acegisecurity (2 CVEs)
TuxCare rebuilt 12 org.acegisecurity packages to address 2 CVEs. Fixed in 1.0.7-tuxcare.1.
- Record
CLSA-2026-1792587913- Updated
- 2026-11-02
OSVCLSA-2026-1792588191 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 3.2.8.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792588191- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-coreMaven |
through 4.2.12 | 4.2.13 |
org.springframework.security:spring-security-casMaven |
through 4.2.12.RELEASE | 4.2.13.RELEASE |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-casTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.acegisecurity:acegi-securityTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-adaptersTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-casTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.acegisecurity:acegi-security-catalinaTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-jbossTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-jettyTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-parentTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-resinTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-samplesTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-samples-contactsTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-samples-tutorialTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.acegisecurity:acegi-security-tigerTuxCare:Maven From an advisory covering 2 CVEs |
1.0.7 up to 1.0.7-tuxcare.1 | 1.0.7-tuxcare.1 |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-casTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
libspring-security-2.0-javaDebian:8 |
before 2.0.7.RELEASE-3+deb8u2, plus listed versions 2.0.7.RELEASE-32.0.7.RELEASE-3+deb8u1 |
2.0.7.RELEASE-3+deb8u2 |
org.springframework.security:spring-security-coreMaven |
before 4.2.13, plus listed versions 2.0.02.0.12.0.22.0.32.0.4 Show 45 moreShow less2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE |
4.2.13 |
org.springframework.security:spring-security-casMaven |
before 4.2.13.RELEASE, plus listed versions 3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE Show 38 moreShow less3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE4.2.10.RELEASE4.2.11.RELEASE4.2.12.RELEASE4.2.2.RELEASE4.2.3.RELEASE4.2.4.RELEASE4.2.5.RELEASE4.2.6.RELEASE4.2.7.RELEASE4.2.8.RELEASE4.2.9.RELEASE |
4.2.13.RELEASE |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-11272 is a high vulnerability (CVSS 7.3) in Spring Security, published June 26, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in org.springframework.security:spring-security-core 4.2.13.
References
Left out here: 11 versions. The JSON record has them.