CVE-2024-22234

In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method.

Specifically, an application is vulnerable if:

The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value.

An application is not vulnerable if any of the following is true:

The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly.
The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated
The application only uses isFullyAuthenticated via Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html or HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html

Database specific

{
    "cna_assigner": "vmware",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22234.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "6.1.x"
                },
                {
                    "fixed": "6.1.7"
                },
                {
                    "introduced": "6.2.x"
                },
                {
                    "fixed": "6.2.2"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/spring-projects/spring-security

Affected ranges

Type

GIT

Repo

https://github.com/spring-projects/spring-security

Events

Introduced

ad2b1d40b881850de5d3a2a3b5e5d1a56a0d2b4c

Fixed

dd5bfc0b3126a33c574354adf8d71fd4b34175ba

Introduced

fd1b92b7d06af8fbaf71d9cdd54e219ac247ef51

Fixed

2cc6cbdb77d761cdfc7d792bb2d772c2b9186e93

Database specific

Show details

{
    "cpe": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "6.1.0"
        },
        {
            "fixed": "6.1.7"
        },
        {
            "introduced": "6.2.0"
        },
        {
            "fixed": "6.2.2"
        }
    ]
}

Affected versions

6.*

6.1.0

6.1.1

6.1.6

6.2.0

6.2.0-M1

6.2.0-M2

6.2.0-RC1

6.2.0-RC2

6.2.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-22234.json"