CVE-2021-22112: Critical severity spring security vulnerability
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-22112.
What is the severity of CVE-2021-22112?
The severity of CVE-2021-22112 is critical.
Which versions of Spring Security are affected by CVE-2021-22112?
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, and 5.2.x prior to 5.2.9.RELEASE are affected.
How can the SecurityContext be saved in Spring Security?
The SecurityContext can be saved using the `SecurityContextHolder.setContext()` method.
How can I fix CVE-2021-22112 in Spring Security?
To fix CVE-2021-22112, upgrade to Spring Security 5.4.4, 5.3.8.RELEASE, or 5.2.9.RELEASE.