| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.security:spring-security-core | ≥ 5.7.0, ≤ 5.7.22≥ 5.8.0, ≤ 5.8.24≥ 6.3.0, ≤ 6.3.15≥ 6.4.0, ≤ 6.4.15≥ 6.5.0, < 6.5.10≥ 7.0.0, < 7.0.5 | 6.5.107.0.5 |
| spring security | ≥ 5.8.0, < 5.8.25≥ 6.3.0, < 6.3.16≥ 6.4.0, < 6.4.16≥ 6.5.0, < 6.5.10≥ 7.0.0, < 7.0.5< 5.7.23 | 5.8.256.3.166.4.166.5.107.0.55.7.23 |
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free