You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to dependency file: /services/cards-publication/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar
Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.
For this to impact an application, all of the following must be true: It must be a WebFlux application, It must be using Spring's static resources support, and it must have a non-permitAll authorization rule applied to the static resources support.
CVE-2024-38821 - Medium Severity Vulnerability
Vulnerable Library - spring-security-web-6.3.3.jar
Spring Security
Library home page: https://spring.io/projects/spring-security
Path to dependency file: /services/cards-publication/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.3/54455b90899cd803e92b020124e859a859f63ee0/spring-security-web-6.3.3.jar
Dependency Hierarchy:
Found in base branch: develop
Vulnerability Details
Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.
For this to impact an application, all of the following must be true: It must be a WebFlux application, It must be using Spring's static resources support, and it must have a non-permitAll authorization rule applied to the static resources support.
Publish Date: 2024-06-20
URL: CVE-2024-38821
CVSS 3 Score Details (5.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2024-38821
Release Date: 2024-06-20
Fix Resolution (org.springframework.security:spring-security-web): 6.3.4
Direct dependency fix Resolution (org.springframework.security:spring-security-test): 6.3.4
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: