« Volver al listado

CVE-2026-40997

Estado: En análisisMedia (5.3)—

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Broadcom — Spring WEB Services

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-40997",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40997",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-11T12:44:15.490096Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Spring",
          "product": "Spring Web Services",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.0",
              "lessThan": "5.0.1.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.1.0",
              "lessThan": "4.1.3.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.0.19",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.1.0",
              "lessThan": "3.1.9",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-11T07:16:27.663",
  "references": [
    {
      "url": "https://spring.io/security/cve-2026-40997",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@vmware.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-209"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.\n\nAffected versions:\nSpring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8."
    },
    {
      "lang": "es",
      "value": "Varios caminos de integración de Spring WS con Spring Security podrían exponer el estado detallado de la cuenta (por ejemplo, semántica de usuario bloqueado o deshabilitado) a clientes SOAP remotos a través de mensajes de excepción o resultados de retrollamada, en lugar de fallar con errores genéricos de autenticación. Ese comportamiento ayuda a los atacantes remotos a distinguir cuentas válidas de inválidas y a inferir el estado del ciclo de vida.\n\nVersiones afectadas:\nSpring Web Services 5.0.0 hasta 5.0.1; 4.1.0 hasta 4.1.3; 4.0.0 hasta 4.0.18; 3.1.0 hasta 3.1.8."
    }
  ],
  "lastModified": "2026-09-04T17:01:57.973",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B633BE6-BF68-4983-9CCC-DB3D353B5E5B",
              "versionEndExcluding": "3.1.9"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78560577-BEE7-4F51-AED1-07BABD369CE9",
              "versionEndExcluding": "4.0.19",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7AB4F88-7609-466A-A799-FD19E8D07284",
              "versionEndExcluding": "4.1.3.1",
              "versionStartIncluding": "4.1.0"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E33A13E-4CED-4B68-8E37-8ACE603F3DAC",
              "versionEndExcluding": "5.0.1.1",
              "versionStartIncluding": "5.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}