certfr_avis - certfr-2025-avi-0792

CERTFR-2025-AVI-0792

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Spring. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Spring	Spring Framework	Framework versions 5.3.x antérieures à 5.3.45
Spring	Spring Framework	Framework versions 6.2.x antérieures à 6.2.11
Spring	Spring Security	Security versions 6.4.x antérieures à 6.4.10
Spring	Spring Security	Security versions 6.5.x antérieures à 6.5.4
Spring	Spring Framework	Framework versions 6.x antérieures à 6.1.23

References

Title

Publication Time

Tags

Bulletin de sécurité Spring cve-2025-41249	2025-09-15	vendor-advisory
Bulletin de sécurité Spring cve-2025-41248	2025-09-15	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Framework versions 5.3.x ant\u00e9rieures \u00e0 5.3.45",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Framework versions 6.2.x ant\u00e9rieures \u00e0 6.2.11",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 6.4.x ant\u00e9rieures \u00e0 6.4.10",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Security versions 6.5.x ant\u00e9rieures \u00e0 6.5.4",
      "product": {
        "name": "Spring Security",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Framework versions 6.x ant\u00e9rieures \u00e0 6.1.23",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-41248",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41248"
    },
    {
      "name": "CVE-2025-41249",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41249"
    }
  ],
  "links": [],
  "reference": "CERTFR-2025-AVI-0792",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-09-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Spring. Elles permettent \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Spring",
  "vendor_advisories": [
    {
      "published_at": "2025-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2025-41249",
      "url": "https://spring.io/security/cve-2025-41249"
    },
    {
      "published_at": "2025-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2025-41248",
      "url": "https://spring.io/security/cve-2025-41248"
    }
  ]
}

CVE-2025-41249 (GCVE-0-2025-41249)

Vulnerability from cvelistv5 – Published: 2025-09-16 10:15 – Updated: 2025-09-16 19:29

Summary

The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions. Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces. This CVE is published in conjunction with CVE-2025-41248 https://spring.io/security/cve-2025-41248 .

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-285 - Improper Authorization

Assigner

vmware

References

URL

Tags

https://spring.io/security/cve-2025-41249

Impacted products

	Vendor	Product	Version
	VMware	Spring Framework	Affected: 6.2.x , < 6.2.11 (OSS) Affected: 6.1.x , < 6.1.23 (commercial) Affected: 5.3.x , < 5.3.45 (COMMERCIAL)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41249",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-16T19:29:22.619095Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-285",
                "description": "CWE-285 Improper Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-16T19:29:37.532Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Spring Framework",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "6.2.11",
              "status": "affected",
              "version": "6.2.x",
              "versionType": "OSS"
            },
            {
              "lessThan": "6.1.23",
              "status": "affected",
              "version": "6.1.x",
              "versionType": "commercial"
            },
            {
              "lessThan": "5.3.45",
              "status": "affected",
              "version": "5.3.x",
              "versionType": "COMMERCIAL"
            }
          ]
        }
      ],
      "datePublic": "2025-09-15T10:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions.\u003c/p\u003e\u003cp\u003eYour application may be affected by this if you are using Spring Security\u0027s \u003ccode\u003e@EnableMethodSecurity\u003c/code\u003e\u0026nbsp;feature.\u003c/p\u003e\u003cp\u003eYou are not affected by this if you are not using \u003ccode\u003e@EnableMethodSecurity\u003c/code\u003e\u0026nbsp;or if you do not use security annotations on methods in generic superclasses or generic interfaces.\u003c/p\u003e\u003cp\u003eThis CVE is published in conjunction with \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://spring.io/security/cve-2025-41248\"\u003eCVE-2025-41248\u003c/a\u003e.\u003c/p\u003e"
            }
          ],
          "value": "The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions.\n\nYour application may be affected by this if you are using Spring Security\u0027s @EnableMethodSecurity\u00a0feature.\n\nYou are not affected by this if you are not using @EnableMethodSecurity\u00a0or if you do not use security annotations on methods in generic superclasses or generic interfaces.\n\nThis CVE is published in conjunction with  CVE-2025-41248 https://spring.io/security/cve-2025-41248 ."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-16T10:15:34.118Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2025-41249"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2025-41249: Spring Framework Annotation Detection Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2025-41249",
    "datePublished": "2025-09-16T10:15:34.118Z",
    "dateReserved": "2025-04-16T09:30:25.625Z",
    "dateUpdated": "2025-09-16T19:29:37.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-41248 (GCVE-0-2025-41248)

Vulnerability from cvelistv5 – Published: 2025-09-16 10:10 – Updated: 2025-09-18 06:29

Summary

The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass. Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces. This CVE is published in conjunction with CVE-2025-41249 https://spring.io/security/cve-2025-41249 .

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-289 - Authentication Bypass by Alternate Name

Assigner

vmware

References

URL

Tags

https://spring.io/security/cve-2025-41248

Impacted products

	Vendor	Product	Version
	VMware	Spring Security	Affected: 6.4.x , < 6.4.11 (OSS) Affected: 6.5.x , < 6.5.5 (OSS)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41248",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-16T19:27:50.837990Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-289",
                "description": "CWE-289 Authentication Bypass by Alternate Name",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-16T19:28:23.179Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Security",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "6.4.11",
              "status": "affected",
              "version": "6.4.x",
              "versionType": "OSS"
            },
            {
              "lessThan": "6.5.5",
              "status": "affected",
              "version": "6.5.x",
              "versionType": "OSS"
            }
          ]
        }
      ],
      "datePublic": "2025-09-15T18:27:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using \u003ccode\u003e@PreAuthorize\u003c/code\u003e\u0026nbsp;and other method security annotations, resulting in an authorization bypass.\u003c/p\u003e\u003cp\u003eYour application may be affected by this if you are using Spring Security\u0027s \u003ccode\u003e@EnableMethodSecurity\u003c/code\u003e\u0026nbsp;feature.\u003c/p\u003e\u003cp\u003eYou are not affected by this if you are not using \u003ccode\u003e@EnableMethodSecurity\u003c/code\u003e\u0026nbsp;or if you do not use security annotations on methods in generic superclasses or generic interfaces.\u003c/p\u003e\u003cp\u003eThis CVE is published in conjunction with \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://spring.io/security/cve-2025-41249\"\u003eCVE-2025-41249\u003c/a\u003e.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize\u00a0and other method security annotations, resulting in an authorization bypass.\n\nYour application may be affected by this if you are using Spring Security\u0027s @EnableMethodSecurity\u00a0feature.\n\nYou are not affected by this if you are not using @EnableMethodSecurity\u00a0or if you do not use security annotations on methods in generic superclasses or generic interfaces.\n\nThis CVE is published in conjunction with  CVE-2025-41249 https://spring.io/security/cve-2025-41249 ."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-18T06:29:51.189Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2025-41248"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2025-41248",
    "datePublished": "2025-09-16T10:10:59.953Z",
    "dateReserved": "2025-04-16T09:30:25.625Z",
    "dateUpdated": "2025-09-18T06:29:51.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2025-AVI-0792

Solutions

CVE-2025-41249 (GCVE-0-2025-41249)

CVE-2025-41248 (GCVE-0-2025-41248)

Tags

Sightings

Nomenclature