Improper authorization control for web services In org.springframework.security:spring-security-config
Description
Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass. This issue affects Spring Security: from 7.0.0 through 7.0.4.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 7.0.5 |
Aliases
1. 2. 3. 4.
References
1.