medium6.5
CVE-2024-38810
Spring Security Missing Authorization vulnerability
Impact
Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.security:spring-security-core | >= 6.3.0, < 6.3.2 | 6.3.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Security | from 6.3.0 before 6.3.2 |