En bref
- CVE-2025-41254 est une vulnérabilité MOYENNE (CVSS 4.3) touchant org.springframework:spring-websocket.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.31%, plus élevée que 24.3% des vulnérabilités.
- Correctif : mettre à jour vers 6.2.12 ou plus récent.
Description
STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.
Affected Spring Products and Versions
Spring Framework:
- 6.2.0 - 6.2.11
- 6.1.0 - 6.1.23
- 6.0.x - 6.0.29
- 5.3.0 - 5.3.45
- Older, unsupported versions are also affected.
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
Affected version(s)
No further mitigation steps are necessary.
CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.
NVD description
STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.
Affected Spring Products and VersionsSpring Framework:
* 6.2.0 - 6.2.11
* 6.1.0 - 6.1.23
* 6.0.x - 6.0.29
* 5.3.0 - 5.3.45
* Older, unsupported versions are also affected.
MitigationUsers of affected versions should upgrade to the corresponding fixed version.
Affected version(s)Fix versionAvailability6.2.x6.2.12OSS6.1.x6.1.24 Commercial https://enterprise.spring.io/ 6.0.xN/A Out of support https://spring.io/projects/spring-framework#support 5.3.x5.3.46 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary.
CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.
Autres vulnérabilités de org.springframework:spring-websocket
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free