CVE-2024-22257: High severity IBM Engineering Requirements Management DOORS and DOORS Web Access vulnerability
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.springframework.security:spring-security-coreto a version that resolves this vulnerability.Fixed in 6.2.3 - Upgrade
Upgrade
maven/org.springframework.security:spring-security-coreto a version that resolves this vulnerability.Fixed in 6.1.8 - Upgrade
Upgrade
maven/org.springframework.security:spring-security-coreto a version that resolves this vulnerability.Fixed in 5.8.11 - Upgrade
Upgrade
maven/org.springframework.security:spring-security-coreto a version that resolves this vulnerability.Fixed in 5.7.12 - Upgrade
Upgrade
Spring Securityto a version that resolves this vulnerability.Fixed in 5.7.12 - Upgrade
Upgrade
Spring Securityto a version that resolves this vulnerability.Fixed in 5.8.11 - Upgrade
Upgrade
Spring Securityto a version that resolves this vulnerability.Fixed in 6.0.9 - Upgrade
Upgrade
Spring Securityto a version that resolves this vulnerability.Fixed in 6.1.8 - Upgrade
Upgrade
Spring Securityto a version that resolves this vulnerability.Fixed in 6.2.3 - Configuration
If your application directly uses AuthenticatedVoter#vote, change the call so the Authentication argument is never null; the material states that passing null results in an erroneous true return value and broken access control.
Spring Security (AuthenticatedVoter) AuthenticatedVoter#vote(Authentication) = Avoid passing a null Authentication parameter (ensure a non-null Authentication is provided or do not use AuthenticatedVoter#vote directly)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22257?
CVE-2024-22257 is classified as a critical vulnerability due to its potential impact on access control.
How do I fix CVE-2024-22257?
You can mitigate CVE-2024-22257 by upgrading to Spring Security versions 5.7.12, 5.8.11, 6.0.9, 6.1.8, or 6.2.3.
Which versions of Spring Security are affected by CVE-2024-22257?
CVE-2024-22257 affects Spring Security versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, 6.0.x prior to 6.0.9, 6.1.x prior to 6.1.8, and 6.2.x prior to 6.2.3.
What type of vulnerability is CVE-2024-22257?
CVE-2024-22257 is a vulnerability related to broken access control in Spring Security.
Can CVE-2024-22257 affect enterprise applications?
Yes, CVE-2024-22257 can affect enterprise applications that utilize the specified vulnerable versions of Spring Security.