« Volver al listado

CVE-2025-41232

Estado: AplazadaCrítica (9.1)—

Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.

Your application may be affected by this if the following are true:

You are not affected if:

Detalles técnicos trazas, registros y código del informe original
  *  You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and
  *  You have Spring Security method annotations on a private method
In that case, the target method may be able to be invoked without proper authorization.

  *  You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or
  *  You have no Spring Security-annotated private methods

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de autorización en Spring Security (AV:N/AC:L/PR:N) explotable remotamente sin autenticación. El bypass permite invocar métodos protegidos sin validación (T1078), accediendo potencialmente a datos (T1005).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Vmware — SecurityAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-41232",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-41232",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-22T03:55:16.784508Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Spring",
          "product": "Spring Security",
          "versions": [
            {
              "status": "affected",
              "version": "6.4.x",
              "lessThan": "6.4.6",
              "versionType": "oss"
            }
          ],
          "packageName": "Spring Security",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-21T12:16:21.993",
  "references": [
    {
      "url": "http://spring.io/security/cve-2025-41232",
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-693"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.\n\nYour application may be affected by this if the following are true:\n\n  *  You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and\n  *  You have Spring Security method annotations on a private method\nIn that case, the target method may be able to be invoked without proper authorization.\n\nYou are not affected if:\n\n  *  You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or\n  *  You have no Spring Security-annotated private methods"
    },
    {
      "lang": "es",
      "value": "Es posible que Spring Security Aspects no ubique correctamente las anotaciones de seguridad de métodos en métodos privados. Esto puede provocar una omisión de autorización. Su aplicación podría verse afectada si se cumplen las siguientes condiciones: * Utiliza @EnableMethodSecurity(mode=ASPECTJ) y spring-security-aspects, y * Tiene anotaciones de método de Spring Security en un método privado. En ese caso, el método de destino podría invocarse sin la autorización correspondiente. No se verá afectado si: * No utiliza @EnableMethodSecurity(mode=ASPECTJ) ni spring-security-aspects, o * No tiene métodos privados anotados por Spring Security."
    }
  ],
  "lastModified": "2026-06-17T09:22:38.570",
  "sourceIdentifier": "security@vmware.com"
}