Spring Security Missing Authorization vulnerability

HOCH 7.5CVE-2024-38810 · GHSA-hmqf-wpq9-jq83 · Published 20/08/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-38810 ist eine Schwachstelle (HOCH (CVSS 7.5)) in org.springframework.security:spring-security-core, spring security (vmware).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.46%, höher als bei 39.7% aller Schwachstellen.
Abhilfe: auf 6.3.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.springframework.security:spring-security-core Maven	`≥ 6.3.0, < 6.3.2`	`6.3.2`
spring security vmware	`≥ 6.3.0, < 6.3.2`	`6.3.2`

Description

Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.

NVD description

Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.

References

nvd.nist.gov/vuln/detail/CVE-2024-38810 · ADVISORY
spring-projects/spring-security · PACKAGE
spring.io/security/cve-2024-38810 · WEB

Weitere Schwachstellen in org.springframework.security:spring-security-core

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.springframework.security:spring-security-core

Maven

≥ 6.3.0, < 6.3.2

6.3.2

spring security

vmware

≥ 6.3.0, < 6.3.2

6.3.2

Description

Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.

NVD description

Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.

Weitere Schwachstellen in org.springframework.security:spring-security-core

Alle anzeigen →