« Volver al listado

CVE-2024-22257

Estado: AplazadaAlta (8.2)—

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Vmware — Spring SecurityAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-22257",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22257",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-12T15:22:14.458591Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "N/A",
          "product": "Spring Security",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.0 to 6.2.2, 6.1.0 to 6.1.7, 6.0.0 to 6.0.9, 5.8.0 to 5.8.10, 5.7.0 to 5.7.11"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:pivotal_software:spring_security:5.7.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:pivotal_software:spring_security:5.8.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:pivotal_software:spring_security:6.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:pivotal_software:spring_security:6.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:pivotal_software:spring_security:6.2.0:*:*:*:*:*:*:*"
          ],
          "vendor": "pivotal_software",
          "product": "spring_security",
          "versions": [
            {
              "status": "affected",
              "version": "5.7.0",
              "versionType": "custom",
              "lessThanOrEqual": "5.7.11"
            },
            {
              "status": "affected",
              "version": "5.8.0",
              "versionType": "custom",
              "lessThanOrEqual": "5.8.10"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.0.9"
            },
            {
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.1.7"
            },
            {
              "status": "affected",
              "version": "6.2.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.2.2"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-03-18T15:15:41.790",
  "references": [
    {
      "url": "https://security.netapp.com/advisory/ntap-20240419-0005/",
      "source": "security@vmware.com"
    },
    {
      "url": "https://spring.io/security/cve-2024-22257",
      "source": "security@vmware.com"
    },
    {
      "url": "https://github.com/dependency-check/DependencyCheck/issues/8642",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20240419-0005/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://spring.io/security/cve-2024-22257",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to \n5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, \nversions 6.2.x prior to 6.2.3, an application is possible vulnerable to \nbroken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter."
    },
    {
      "lang": "es",
      "value": "En Spring Security, versiones 5.7.x anteriores a 5.7.12, 5.8.x anteriores a 5.8.11, versiones 6.0.x anteriores a 6.0.9, versiones 6.1.x anteriores a 6.1.8, versiones 6.2.x anteriores a 6.2 .3, una aplicación es posiblemente vulnerable a un control de acceso roto cuando utiliza directamente el voto Autenticado#voto pasando un parámetro de autenticación nulo."
    }
  ],
  "lastModified": "2026-06-30T13:16:50.783",
  "sourceIdentifier": "security@vmware.com"
}