NetSight
IP …
high8.8

CVE-2021-22112

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityC…

Impact

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.

Affected products

VendorProductAffected versions
Pivotal SoftwareSpring Security
before 5.2.9
from 5.3.0 before 5.3.8
VmwareSpring Security
from 5.4.0 before 5.4.4
OracleCommunications Element Manager
from 8.2.0 through 8.2.4.0
OracleCommunications Interactive Session Recorder
Versions 6.3, 6.4
OracleCommunications Unified Inventory Management
Version 7.4.1
OracleHospitality Cruise Shipboard Property Management System
Version 20.1.0
OracleInsurance Policy Administration
Versions 11.2.0, 11.3.0
OracleMysql Enterprise Monitor
through 8.0.25

References