Insecure service configuration In libspring-java
Description
Affected versions of this package are vulnerable to Information Exposure. It allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers, and MappingJackson2JsonView for browser requests. When MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the jsonp and callback JSONP parameters, enabling cross-domain requests. Allowing cross-domain requests from untrusted origins may expose user information to 3rd party browser scripts
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 12 | 4.3.19-1 | ||
 maven | 5.0.7.release, 4.3.18.release | ||
debian 14 | 4.3.19-1 | ||
maven | 4.3.18.release, 5.0.7.release | ||
debian 13 | 4.3.19-1 | ||
debian 11 | 4.3.19-1 | ||
maven | - |
Aliases
References