Improper authorization in Spring Security - CVE-2025-41232

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU109589

Improper authorization in Spring Security - CVE-2025-41232

Published: May 21, 2025


Vulnerability identifier: #VU109589
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-41232
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the affected application.

The vulnerability exists due to an error in Spring Security Aspects, that may not correctly locate method security annotations on private methods. A remote non-authenticated attacker can bypass authorization checks and gain unauthorized access to the application. 

The vulnerability affects system that:

  1. use @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and
  2. have Spring Security method annotations on a private method



Affected software

Spring Security
IBM Process Mining
IBM Sterling Control Center
IBM Cloud Pak for Business Automation
Storage Defender Copy Data Management
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
IBM Business Automation Manager Open Editions
Maximo Application Suite Ai Service

How to mitigate CVE-2025-41232

Install updates from vendor's website.

Spring Security - update to 6.4.6
IBM Process Mining - update to 2.1.0
Storage Defender Copy Data Management - update to 2.3.1.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2.0.1
IBM Sterling Control Center - update to 6.4.0.0.2
IBM Business Automation Manager Open Editions - update to 9.2.1
Maximo Application Suite Ai Service - update to 9.0.6
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF007, 24.0.1-IF006, 25.0.0-IF003

External References

Related Security Bulletins