In breve
- CVE-2025-41254 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda org.springframework:spring-websocket.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.31%, superiore al 24.3% delle vulnerabilità.
- Correzione: aggiornare a 6.2.12 o successiva.
Description
STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.
Affected Spring Products and Versions
Spring Framework:
- 6.2.0 - 6.2.11
- 6.1.0 - 6.1.23
- 6.0.x - 6.0.29
- 5.3.0 - 5.3.45
- Older, unsupported versions are also affected.
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
Affected version(s)
No further mitigation steps are necessary.
CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.
NVD description
STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.
Affected Spring Products and VersionsSpring Framework:
* 6.2.0 - 6.2.11
* 6.1.0 - 6.1.23
* 6.0.x - 6.0.29
* 5.3.0 - 5.3.45
* Older, unsupported versions are also affected.
MitigationUsers of affected versions should upgrade to the corresponding fixed version.
Affected version(s)Fix versionAvailability6.2.x6.2.12OSS6.1.x6.1.24 Commercial https://enterprise.spring.io/ 6.0.xN/A Out of support https://spring.io/projects/spring-framework#support 5.3.x5.3.46 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary.
CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser.
Altre vulnerabilità di org.springframework:spring-websocket
Vedi tutto →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free