CVE-2024-22234 (GCVE-0-2024-22234)

Vulnerability from cvelistv5 – Published: 2024-02-20 07:02 – Updated: 2025-02-13 17:33
VLAI?
Title
CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated
Summary
In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. Specifically, an application is vulnerable if: * The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value. An application is not vulnerable if any of the following is true: * The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly. * The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated * The application only uses isFullyAuthenticated via Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html
Severity ?
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
  • CWE-284 - Improper Access Control
Assigner
References
Impacted products
Vendor Product Version
Spring Spring Security Affected: 6.1.x , < 6.1.7 (6.1.7)
Affected: 6.2.x , < 6.2.2 (6.2.2)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:vmware:spring_security:6.1.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "spring_security",
            "vendor": "vmware",
            "versions": [
              {
                "lessThan": "6.1.7",
                "status": "affected",
                "version": "6.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:vmware:spring_security:6.2.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "spring_security",
            "vendor": "vmware",
            "versions": [
              {
                "lessThan": "6.2.2",
                "status": "affected",
                "version": "6.2.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22234",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-21T19:46:52.509563Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-26T17:21:05.285Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:43:33.656Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://spring.io/security/cve-2024-22234"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240315-0003/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Security",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "6.1.7",
              "status": "affected",
              "version": "6.1.x",
              "versionType": "6.1.7"
            },
            {
              "lessThan": "6.2.2",
              "status": "affected",
              "version": "6.2.x",
              "versionType": "6.2.2"
            }
          ]
        }
      ],
      "datePublic": "2024-02-19T08:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the \u003ccode\u003eAuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u003c/code\u003e\u0026nbsp;method.\u003c/p\u003e\u003cp\u003eSpecifically, an application is vulnerable if:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe application uses \u003ccode\u003eAuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u003c/code\u003e\u0026nbsp;directly and a \u003ccode\u003enull\u003c/code\u003e\u0026nbsp;authentication parameter is passed to it resulting in an erroneous \u003ccode\u003etrue\u003c/code\u003e\u0026nbsp;return value.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eAn application is not vulnerable if any of the following is true:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe application does not use \u003ccode\u003eAuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u003c/code\u003e\u0026nbsp;directly.\u003c/li\u003e\u003cli\u003eThe application does not pass \u003ccode\u003enull\u003c/code\u003e\u0026nbsp;to \u003ccode\u003eAuthenticationTrustResolver.isFullyAuthenticated\u003c/code\u003e\u003c/li\u003e\u003cli\u003eThe application only uses \u003ccode\u003eisFullyAuthenticated\u003c/code\u003e\u0026nbsp;via \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html\"\u003eMethod Security\u003c/a\u003e\u0026nbsp;or \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html\"\u003eHTTP Request Security\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e"
            }
          ],
          "value": "In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u00a0method.\n\nSpecifically, an application is vulnerable if:\n\n  *  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u00a0directly and a null\u00a0authentication parameter is passed to it resulting in an erroneous true\u00a0return value.\n\n\nAn application is not vulnerable if any of the following is true:\n\n  *  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u00a0directly.\n  *  The application does not pass null\u00a0to AuthenticationTrustResolver.isFullyAuthenticated\n  *  The application only uses isFullyAuthenticated\u00a0via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html \u00a0or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-15T11:06:18.496Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2024-22234"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240315-0003/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2024-22234",
    "datePublished": "2024-02-20T07:02:50.873Z",
    "dateReserved": "2024-01-08T16:40:16.141Z",
    "dateUpdated": "2025-02-13T17:33:37.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\\u00a0method.\\n\\nSpecifically, an application is vulnerable if:\\n\\n  *  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\\u00a0directly and a null\\u00a0authentication parameter is passed to it resulting in an erroneous true\\u00a0return value.\\n\\n\\nAn application is not vulnerable if any of the following is true:\\n\\n  *  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\\u00a0directly.\\n  *  The application does not pass null\\u00a0to AuthenticationTrustResolver.isFullyAuthenticated\\n  *  The application only uses isFullyAuthenticated\\u00a0via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html \\u00a0or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html \\n\\n\\n\\n\"}, {\"lang\": \"es\", \"value\": \"En Spring Security, versiones 6.1.x anteriores a 6.1.7 y versiones 6.2.x anteriores a 6.2.2, una aplicaci\\u00f3n es vulnerable a un control de acceso roto cuando utiliza directamente el m\\u00e9todo AuthenticationTrustResolver.isFullyAuthenticated(Authentication). Espec\\u00edficamente, una aplicaci\\u00f3n es vulnerable si: * La aplicaci\\u00f3n usa AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directamente y se le pasa un par\\u00e1metro de autenticaci\\u00f3n nulo, lo que genera un valor de retorno verdadero err\\u00f3neo. Una aplicaci\\u00f3n no es vulnerable si se cumple alguna de las siguientes condiciones: * La aplicaci\\u00f3n no utiliza AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directamente. * La aplicaci\\u00f3n no pasa nulo a AuthenticationTrustResolver.isFullyAuthenticated * La aplicaci\\u00f3n solo usa isFullyAuthenticated a trav\\u00e9s de Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html o HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html\"}]",
      "id": "CVE-2024-22234",
      "lastModified": "2024-11-21T08:55:51.493",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@vmware.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 7.4, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.2}]}",
      "published": "2024-02-20T07:15:09.967",
      "references": "[{\"url\": \"https://security.netapp.com/advisory/ntap-20240315-0003/\", \"source\": \"security@vmware.com\"}, {\"url\": \"https://spring.io/security/cve-2024-22234\", \"source\": \"security@vmware.com\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240315-0003/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://spring.io/security/cve-2024-22234\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@vmware.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-284\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-22234\",\"sourceIdentifier\":\"security@vmware.com\",\"published\":\"2024-02-20T07:15:09.967\",\"lastModified\":\"2025-04-02T20:10:31.627\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u00a0method.\\n\\nSpecifically, an application is vulnerable if:\\n\\n  *  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u00a0directly and a null\u00a0authentication parameter is passed to it resulting in an erroneous true\u00a0return value.\\n\\n\\nAn application is not vulnerable if any of the following is true:\\n\\n  *  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u00a0directly.\\n  *  The application does not pass null\u00a0to AuthenticationTrustResolver.isFullyAuthenticated\\n  *  The application only uses isFullyAuthenticated\u00a0via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html \u00a0or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html\"},{\"lang\":\"es\",\"value\":\"En Spring Security, versiones 6.1.x anteriores a 6.1.7 y versiones 6.2.x anteriores a 6.2.2, una aplicaci\u00f3n es vulnerable a un control de acceso roto cuando utiliza directamente el m\u00e9todo AuthenticationTrustResolver.isFullyAuthenticated(Authentication). Espec\u00edficamente, una aplicaci\u00f3n es vulnerable si: * La aplicaci\u00f3n usa AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directamente y se le pasa un par\u00e1metro de autenticaci\u00f3n nulo, lo que genera un valor de retorno verdadero err\u00f3neo. Una aplicaci\u00f3n no es vulnerable si se cumple alguna de las siguientes condiciones: * La aplicaci\u00f3n no utiliza AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directamente. * La aplicaci\u00f3n no pasa nulo a AuthenticationTrustResolver.isFullyAuthenticated * La aplicaci\u00f3n solo usa isFullyAuthenticated a trav\u00e9s de Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html o HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.0\",\"versionEndExcluding\":\"6.1.7\",\"matchCriteriaId\":\"564058EB-83BD-4201-92DE-0E1AE03010C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2.0\",\"versionEndExcluding\":\"6.2.2\",\"matchCriteriaId\":\"00671E75-D41E-4F65-9F61-5F6DEDAA0D5A\"}]}]}],\"references\":[{\"url\":\"https://security.netapp.com/advisory/ntap-20240315-0003/\",\"source\":\"security@vmware.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://spring.io/security/cve-2024-22234\",\"source\":\"security@vmware.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20240315-0003/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://spring.io/security/cve-2024-22234\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://spring.io/security/cve-2024-22234\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240315-0003/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T22:43:33.656Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-22234\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-21T19:46:52.509563Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:vmware:spring_security:6.1.0:*:*:*:*:*:*:*\"], \"vendor\": \"vmware\", \"product\": \"spring_security\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.1.0\", \"lessThan\": \"6.1.7\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:vmware:spring_security:6.2.0:*:*:*:*:*:*:*\"], \"vendor\": \"vmware\", \"product\": \"spring_security\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2.0\", \"lessThan\": \"6.2.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284 Improper Access Control\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-26T17:20:13.341Z\"}}], \"cna\": {\"title\": \"CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Spring\", \"product\": \"Spring Security\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.1.x\", \"lessThan\": \"6.1.7\", \"versionType\": \"6.1.7\"}, {\"status\": \"affected\", \"version\": \"6.2.x\", \"lessThan\": \"6.2.2\", \"versionType\": \"6.2.2\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2024-02-19T08:59:00.000Z\", \"references\": [{\"url\": \"https://spring.io/security/cve-2024-22234\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240315-0003/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\\u00a0method.\\n\\nSpecifically, an application is vulnerable if:\\n\\n  *  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\\u00a0directly and a null\\u00a0authentication parameter is passed to it resulting in an erroneous true\\u00a0return value.\\n\\n\\nAn application is not vulnerable if any of the following is true:\\n\\n  *  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\\u00a0directly.\\n  *  The application does not pass null\\u00a0to AuthenticationTrustResolver.isFullyAuthenticated\\n  *  The application only uses isFullyAuthenticated\\u00a0via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html \\u00a0or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html \\n\\n\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIn Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the \u003ccode\u003eAuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u003c/code\u003e\u0026nbsp;method.\u003c/p\u003e\u003cp\u003eSpecifically, an application is vulnerable if:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe application uses \u003ccode\u003eAuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u003c/code\u003e\u0026nbsp;directly and a \u003ccode\u003enull\u003c/code\u003e\u0026nbsp;authentication parameter is passed to it resulting in an erroneous \u003ccode\u003etrue\u003c/code\u003e\u0026nbsp;return value.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eAn application is not vulnerable if any of the following is true:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe application does not use \u003ccode\u003eAuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u003c/code\u003e\u0026nbsp;directly.\u003c/li\u003e\u003cli\u003eThe application does not pass \u003ccode\u003enull\u003c/code\u003e\u0026nbsp;to \u003ccode\u003eAuthenticationTrustResolver.isFullyAuthenticated\u003c/code\u003e\u003c/li\u003e\u003cli\u003eThe application only uses \u003ccode\u003eisFullyAuthenticated\u003c/code\u003e\u0026nbsp;via \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html\\\"\u003eMethod Security\u003c/a\u003e\u0026nbsp;or \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html\\\"\u003eHTTP Request Security\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"shortName\": \"vmware\", \"dateUpdated\": \"2024-02-20T07:02:50.873Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-22234\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T22:43:33.656Z\", \"dateReserved\": \"2024-01-08T16:40:16.141Z\", \"assignerOrgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"datePublished\": \"2024-02-20T07:02:50.873Z\", \"assignerShortName\": \"vmware\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.