cnvd - cnvd-2019-19044

CNVD-2019-19044

Vulnerability from cnvd - Published: 2019-06-24

Title

Pivotal Software Spring Security身份验证漏洞

Description

Pivotal Software Spring Security是美国Pivotal Software公司的一套为基于Spring的应用程序提供说明性安全保护的安全框架。 Pivotal Software Spring Security 4.2.x版本至4.2.12版本和不再支持的老版本中存在安全漏洞。攻击者可利用该漏洞通过身份验证。

Severity

低

Patch Name

Pivotal Software Spring Security身份验证漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://pivotal.io/security/cve-2019-11272

Reference

https://pivotal.io/security/cve-2019-11272

Impacted products

Name
SpringSource Spring Security >=4.2.*，<=4.2.12

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-11272",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-11272"
    }
  },
  "description": "Pivotal Software Spring Security\u662f\u7f8e\u56fdPivotal Software\u516c\u53f8\u7684\u4e00\u5957\u4e3a\u57fa\u4e8eSpring\u7684\u5e94\u7528\u7a0b\u5e8f\u63d0\u4f9b\u8bf4\u660e\u6027\u5b89\u5168\u4fdd\u62a4\u7684\u5b89\u5168\u6846\u67b6\u3002\n\nPivotal Software Spring Security 4.2.x\u7248\u672c\u81f34.2.12\u7248\u672c\u548c\u4e0d\u518d\u652f\u6301\u7684\u8001\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u3002",
  "discovererName": "Tim B\u00fcthe and Daniel Neagaru from mytaxi",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://pivotal.io/security/cve-2019-11272",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-19044",
  "openTime": "2019-06-24",
  "patchDescription": "Pivotal Software Spring Security\u662f\u7f8e\u56fdPivotal Software\u516c\u53f8\u7684\u4e00\u5957\u4e3a\u57fa\u4e8eSpring\u7684\u5e94\u7528\u7a0b\u5e8f\u63d0\u4f9b\u8bf4\u660e\u6027\u5b89\u5168\u4fdd\u62a4\u7684\u5b89\u5168\u6846\u67b6\u3002\n\nPivotal Software Spring Security 4.2.x\u7248\u672c\u81f34.2.12\u7248\u672c\u548c\u4e0d\u518d\u652f\u6301\u7684\u8001\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Pivotal Software Spring Security\u8eab\u4efd\u9a8c\u8bc1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "SpringSource Spring Security \u003e=4.2.*\uff0c\u003c=4.2.12"
  },
  "referenceLink": "https://pivotal.io/security/cve-2019-11272",
  "serverity": "\u4f4e",
  "submitTime": "2019-06-24",
  "title": "Pivotal Software Spring Security\u8eab\u4efd\u9a8c\u8bc1\u6f0f\u6d1e"
}

CVE-2019-11272 (GCVE-0-2019-11272)

Vulnerability from cvelistv5 – Published: 2019-06-26 14:06 – Updated: 2024-09-16 19:25

Summary

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".

Severity ?

No CVSS data available.

CWE

CWE-287 - Improper Authentication - Generic

Assigner

pivotal

References

URL

Tags

	https://pivotal.io/security/cve-2019-11272	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Spring	Spring Security	Affected: 4.2 , < 4.2.13.RELEASE (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T22:48:09.049Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://pivotal.io/security/cve-2019-11272"
          },
          {
            "name": "[debian-lts-announce] 20190709 [SECURITY] [DLA 1848-1] libspring-security-2.0-java security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Spring Security",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.2.13.RELEASE",
              "status": "affected",
              "version": "4.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2019-06-20T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of \"null\"."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-07-09T08:06:02",
        "orgId": "862b2186-222f-48b9-af87-f1fb7bb26d03",
        "shortName": "pivotal"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://pivotal.io/security/cve-2019-11272"
        },
        {
          "name": "[debian-lts-announce] 20190709 [SECURITY] [DLA 1848-1] libspring-security-2.0-java security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00008.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "PlaintextPasswordEncoder authenticates encoded passwords that are null",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@pivotal.io",
          "DATE_PUBLIC": "2019-06-20T20:19:44.000Z",
          "ID": "CVE-2019-11272",
          "STATE": "PUBLIC",
          "TITLE": "PlaintextPasswordEncoder authenticates encoded passwords that are null"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Spring Security",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_name": "4.2",
                            "version_value": "4.2.13.RELEASE"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Spring"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of \"null\"."
            }
          ]
        },
        "impact": null,
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-287: Improper Authentication - Generic"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://pivotal.io/security/cve-2019-11272",
              "refsource": "CONFIRM",
              "url": "https://pivotal.io/security/cve-2019-11272"
            },
            {
              "name": "[debian-lts-announce] 20190709 [SECURITY] [DLA 1848-1] libspring-security-2.0-java security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00008.html"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "862b2186-222f-48b9-af87-f1fb7bb26d03",
    "assignerShortName": "pivotal",
    "cveId": "CVE-2019-11272",
    "datePublished": "2019-06-26T14:06:15.312137Z",
    "dateReserved": "2019-04-18T00:00:00",
    "dateUpdated": "2024-09-16T19:25:59.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2019-19044

CVE-2019-11272 (GCVE-0-2019-11272)

Tags

Sightings

Nomenclature