{"id":"CVE-2019-11272","aliases":["CLSA-2026-1775694713","CLSA-2026-1792587913","CLSA-2026-1792588191","DEBIAN-CVE-2019-11272","DLA-1848-1","EUVD-2019-0562","GHSA-v33x-prhc-gph5"],"status":"published","title":"PlaintextPasswordEncoder authenticates encoded passwords that are null","description":"Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of \"null\".","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01382,"percentile":0.72334,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-522"],"published":"2019-06-26T14:06:15Z","modified":"2026-11-02T19:46:29Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.security:spring-security-core","fixed_in":["4.2.13"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.springframework.security:spring-security-cas","fixed_in":["4.2.13.RELEASE"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:8","package":"libspring-security-2.0-java","fixed_in":["2.0.7.RELEASE-3+deb8u2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.2.12"},{"fixed":"4.2.13"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-cas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.2.12.RELEASE"},{"fixed":"4.2.13.RELEASE"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.RELEASE"},{"fixed":"4.2.12.RELEASE-tuxcare.1"}]}],"versions":["4.2.12.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-cas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.RELEASE"},{"fixed":"4.2.12.RELEASE-tuxcare.1"}]}],"versions":["4.2.12.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.RELEASE"},{"fixed":"4.2.12.RELEASE-tuxcare.1"}]}],"versions":["4.2.12.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.RELEASE"},{"fixed":"4.2.12.RELEASE-tuxcare.1"}]}],"versions":["4.2.12.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.RELEASE"},{"fixed":"4.2.12.RELEASE-tuxcare.1"}]}],"versions":["4.2.12.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.acegisecurity:acegi-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7"},{"fixed":"1.0.7-tuxcare.1"}]}],"versions":["1.0.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.acegisecurity:acegi-security-adapters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7"},{"fixed":"1.0.7-tuxcare.1"}]}],"versions":["1.0.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.acegisecurity:acegi-security-cas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7"},{"fixed":"1.0.7-tuxcare.1"}]}],"versions":["1.0.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.acegisecurity:acegi-security-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7"},{"fixed":"1.0.7-tuxcare.1"}]}],"versions":["1.0.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.acegisecurity:acegi-security-jboss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7"},{"fixed":"1.0.7-tuxcare.1"}]}],"versions":["1.0.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.acegisecurity:acegi-security-jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7"},{"fixed":"1.0.7-tuxcare.1"}]}],"versions":["1.0.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.acegisecurity:acegi-security-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7"},{"fixed":"1.0.7-tuxcare.1"}]}],"versions":["1.0.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.acegisecurity:acegi-security-resin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7"},{"fixed":"1.0.7-tuxcare.1"}]}],"versions":["1.0.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.acegisecurity:acegi-security-samples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7"},{"fixed":"1.0.7-tuxcare.1"}]}],"versions":["1.0.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.acegisecurity:acegi-security-samples-contacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7"},{"fixed":"1.0.7-tuxcare.1"}]}],"versions":["1.0.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.acegisecurity:acegi-security-samples-tutorial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7"},{"fixed":"1.0.7-tuxcare.1"}]}],"versions":["1.0.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.acegisecurity:acegi-security-tiger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7"},{"fixed":"1.0.7-tuxcare.1"}]}],"versions":["1.0.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.8.RELEASE"},{"fixed":"3.2.8.RELEASE-tuxcare.1"}]}],"versions":["3.2.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-cas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.8.RELEASE"},{"fixed":"3.2.8.RELEASE-tuxcare.1"}]}],"versions":["3.2.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.8.RELEASE"},{"fixed":"3.2.8.RELEASE-tuxcare.1"}]}],"versions":["3.2.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.8.RELEASE"},{"fixed":"3.2.8.RELEASE-tuxcare.1"}]}],"versions":["3.2.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.8.RELEASE"},{"fixed":"3.2.8.RELEASE-tuxcare.1"}]}],"versions":["3.2.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"Debian:8","package":"libspring-security-2.0-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7.RELEASE-3+deb8u2"}]}],"versions":["2.0.7.RELEASE-3","2.0.7.RELEASE-3+deb8u1"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.13"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5.RELEASE","2.0.6.RELEASE","2.0.7.RELEASE","2.0.8.RELEASE","3.0.0.RELEASE","3.0.1.RELEASE","3.0.2.RELEASE","3.0.3.RELEASE","3.0.4.RELEASE","3.0.5.RELEASE","3.0.6.RELEASE","3.0.7.RELEASE","3.0.8.RELEASE","3.1.0.RELEASE","3.1.1.RELEASE","3.1.2.RELEASE","3.1.3.RELEASE","3.1.4.RELEASE","3.1.5.RELEASE","3.1.6.RELEASE","3.1.7.RELEASE","3.2.0.RELEASE","3.2.1.RELEASE","3.2.10.RELEASE","3.2.2.RELEASE","3.2.3.RELEASE","3.2.4.RELEASE","3.2.5.RELEASE","3.2.6.RELEASE","3.2.7.RELEASE","3.2.8.RELEASE","3.2.9.RELEASE","4.0.0.RELEASE","4.0.1.RELEASE","4.0.2.RELEASE","4.0.3.RELEASE","4.0.4.RELEASE","4.1.0.RELEASE","4.1.1.RELEASE","4.1.2.RELEASE","4.1.3.RELEASE","4.1.4.RELEASE","4.1.5.RELEASE","4.2.0.RELEASE","4.2.1.RELEASE","4.2.10.RELEASE","4.2.11.RELEASE","4.2.12.RELEASE","4.2.2.RELEASE","4.2.3.RELEASE","4.2.4.RELEASE","4.2.5.RELEASE","4.2.6.RELEASE","4.2.7.RELEASE","4.2.8.RELEASE","4.2.9.RELEASE"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-cas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.13.RELEASE"}]}],"versions":["3.1.0.RELEASE","3.1.1.RELEASE","3.1.2.RELEASE","3.1.3.RELEASE","3.1.4.RELEASE","3.1.5.RELEASE","3.1.6.RELEASE","3.1.7.RELEASE","3.2.0.RELEASE","3.2.1.RELEASE","3.2.10.RELEASE","3.2.2.RELEASE","3.2.3.RELEASE","3.2.4.RELEASE","3.2.5.RELEASE","3.2.6.RELEASE","3.2.7.RELEASE","3.2.8.RELEASE","3.2.9.RELEASE","4.0.0.RELEASE","4.0.1.RELEASE","4.0.2.RELEASE","4.0.3.RELEASE","4.0.4.RELEASE","4.1.0.RELEASE","4.1.1.RELEASE","4.1.2.RELEASE","4.1.3.RELEASE","4.1.4.RELEASE","4.1.5.RELEASE","4.2.0.RELEASE","4.2.1.RELEASE","4.2.10.RELEASE","4.2.11.RELEASE","4.2.12.RELEASE","4.2.2.RELEASE","4.2.3.RELEASE","4.2.4.RELEASE","4.2.5.RELEASE","4.2.6.RELEASE","4.2.7.RELEASE","4.2.8.RELEASE","4.2.9.RELEASE"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"spring","product":"spring security"},{"vendor":"vmware","product":"spring_security"}],"references":[{"url":"https://pivotal.io/security/cve-2019-11272","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00008.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11272","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v33x-prhc-gph5"}],"sources":{"cve":[{"id":"CVE-2019-11272","title":"PlaintextPasswordEncoder authenticates encoded passwords that are null","description":"Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of \"null\".","status":"published","published":"2019-06-26T14:06:15.312Z","modified":"2024-09-16T19:25:59.208Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:32:22.432545Z"}],"euvd":[{"id":"EUVD-2019-0562","description":"Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of \"null\".","status":"published","published":"2019-06-26T14:06:15Z","modified":"2024-09-16T19:25:59Z","updated_at":"2026-11-03T00:55:22.776544Z"}],"ghsa":[{"id":"GHSA-v33x-prhc-gph5","title":"Insufficiently Protected Credentials and Improper Authentication in Spring Security","description":"Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of ?null?.","status":"published","published":"2019-06-27T17:24:58Z","modified":"2023-01-28T05:00:56Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-287","CWE-522"],"updated_at":"2026-11-02T14:36:22.592333Z"}],"nvd":[{"id":"CVE-2019-11272","description":"Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of \"null\".","status":"published","published":"2019-06-26T14:15:09.98Z","modified":"2026-06-17T02:12:38.923Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287","CWE-522"],"updated_at":"2026-11-02T14:05:17.695191Z"}],"osv":[{"id":"CVE-2019-11272","description":"Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of \"null\".","status":"published","published":"2019-06-26T14:15:09.98Z","modified":"2026-10-24T10:30:31.306011214Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-v33x-prhc-gph5","title":"Insufficiently Protected Credentials and Improper Authentication in Spring Security","description":"Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of ?null?.","status":"published","published":"2019-06-27T17:24:58Z","modified":"2023-11-08T04:01:00.599848Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-287","CWE-522"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"CLSA-2026-1775694713","title":"TuxCare security update for org.springframework.security (6 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 4.2.12.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-11-02T19:45:22.46726315Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1792587913","title":"TuxCare security update for org.acegisecurity (2 CVEs)","description":"TuxCare rebuilt 12 org.acegisecurity packages to address 2 CVEs. Fixed in 1.0.7-tuxcare.1.","status":"published","published":"2026-10-21T13:05:13Z","modified":"2026-10-21T20:30:05.321180596Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792588191","title":"TuxCare security update for org.springframework.security (9 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 3.2.8.RELEASE-tuxcare.1.","status":"published","published":"2026-10-21T13:09:51Z","modified":"2026-11-02T19:46:29.61327736Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"DLA-1848-1","title":"libspring-security-2.0-java - security update","status":"published","published":"2019-07-08T00:00:00Z","modified":"2026-03-09T01:22:41.665725Z","updated_at":"2026-11-02T15:46:09.777694Z"}]}}