CVE-2024-22257

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-18 · updated 2026-06-30
Weakness: CWE-862

Description

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

Affected products

Spring by VMware Spring Security: from 5.7.0 through 5.7.11; from 5.8.0 through 5.8.10; from 6.0.0 through 6.0.9; from 6.1.0 through 6.1.7; from 6.2.0 through 6.2.2

References

https://security.netapp.com/advisory/ntap-20240419-0005/
https://spring.io/security/cve-2024-22257
https://github.com/dependency-check/DependencyCheck/issues/8642
https://security.netapp.com/advisory/ntap-20240419-0005/
https://spring.io/security/cve-2024-22257

Get alerted when CVE-2024-22257 or the next vulnerability affects your stack