Improper authorization in Spring Security - CVE-2025-41232
Published: May 21, 2025
Vulnerability identifier: #VU109589
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2025-41232
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
Spring Security
IBM Process Mining
IBM Sterling Control Center
IBM Cloud Pak for Business Automation
Storage Defender Copy Data Management
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
IBM Business Automation Manager Open Editions
Maximo Application Suite Ai Service
Spring Security
IBM Process Mining
IBM Sterling Control Center
IBM Cloud Pak for Business Automation
Storage Defender Copy Data Management
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
IBM Business Automation Manager Open Editions
Maximo Application Suite Ai Service
Detailed vulnerability description
The vulnerability allows a remote attacker to compromise the affected application.
The vulnerability exists due to an error in Spring Security Aspects, that may not correctly locate method security annotations on private methods. A remote non-authenticated attacker can bypass authorization checks and gain unauthorized access to the application.
The vulnerability affects system that:
- use
@EnableMethodSecurity(mode=ASPECTJ)andspring-security-aspects, and - have Spring Security method annotations on a private method
How to mitigate CVE-2025-41232
Install updates from vendor's website.