VMware Spring Security 4.2.12

CPE Details

VMware Spring Security 4.2.12
vmware
spring_security
4.2.12
2021-06-08
16h11 +00:00
2021-06-08
16h20 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:vmware:spring_security:4.2.12:*:*:*:*:*:*:*

Informations

Vendor

vmware

Product

spring_security

Version

4.2.12

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2022-22978 2022-05-18 22h00 +00:00 In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
9.8
Critical
CVE-2020-5408 2020-05-14 17h15 +00:00 Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
6.5
Medium
CVE-2019-11272 2019-06-26 14h06 +00:00 Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".
7.3
High