Protection Mechanism Failure in Spring Security - CVE-2025-41248

Vulnerability identifier: #VU115570

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-41248

CWE-ID: CWE-693

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the annotation detection mechanism does not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. A remote attacker can gain access to sensitive information. 

Spring Security
Netezza Appliance
Storage Defender Copy Data Management
DB2 Data Management Console
Guardium Data Security Center (GDSC)
OpenPages for IBM Cloud Pak for Data
UrbanCode Build
DevOps
OpenPages Cloud pak for data service version
IBM Business Automation Manager Open Editions
CICS Transaction Gateway Desktop Edition
CICS Transaction Gateway for Multiplatforms
Business Automation Insights
Maximo Application Suite - IoT Component
IBM OpenPages with Watson
IBM Observability with Instana
IBM Process Mining
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Sterling Partner Engagement Manager
IBM Sterling Control Center
Crowd Data Center
IBM Rational Build Forge
Oracle Financial Services Model Management and Governance
Bitbucket Data Center
Confluence Data Center
Jira Software Data Center
Jira Service Management Data Center
Jira Service Management Server
IBM Cloud Pak for Business Automation
Oracle Communications Cloud Native Core Network Repository Function
Red Hat OpenShift Dev Spaces
IBM Sterling Connect:Direct Web Services
Communications Unified Assurance
IBM Sterling File Gateway
Bitbucket Server
Confluence Server
Jira Software Server
IBM InfoSphere Information Server
Oracle WebCenter Sites
Oracle Banking Branch
Library Support for Spring
Red Hat Camel for Spring Boot

Install updates from vendor's website.

Spring Security - addressed in versions 6.4.10, 6.5.4
Netezza Appliance - update to 1.0.0.1
IBM Observability with Instana - update to 1.0.309
IBM Process Mining - update to 2.1.0
Storage Defender Copy Data Management - update to 2.3.1.0
DB2 Data Management Console - update to 3.1.13.2
Guardium Data Security Center (GDSC) - update to 3.8.5
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3
OpenPages for IBM Cloud Pak for Data - update to 5.2.2
IBM Sterling File Gateway - addressed in versions 6.2.1.2, 6.2.2.0
IBM Sterling B2B Integrator - addressed in versions 6.2.1.2, 6.2.2.0
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.6, 6.2.4.4
IBM Sterling Control Center - addressed in versions 6.3.1.0.6, 6.4.0.0.2, 6.4.1.0.1
Crowd Data Center - update to 7.0.2
DevOps - update to 7.1.0.2
IBM Rational Build Forge - update to 8.0.0.29
OpenPages Cloud pak for data service version - update to 9.5.2
IBM Business Automation Manager Open Editions - update to 9.3.1
Bitbucket Server - update to 10.0.2
Bitbucket Data Center - update to 10.0.2
Confluence Server - update to 10.1.1
Confluence Data Center - update to 10.1.1
Jira Software Server - update to 11.2.0
Jira Software Data Center - update to 11.2.0
Jira Service Management Data Center - update to 11.2.0
Jira Service Management Server - update to 11.2.0
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 1
Business Automation Insights - addressed in versions 24.0.0.0.6, 24.0.1.0.6, 25.0.0.0.3
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF007, 24.0.1-IF006, 25.0.0-IF003
Library Support for Spring - update to 2.7.29
Red Hat OpenShift Dev Spaces - update to 3.24.0
Red Hat Camel for Spring Boot - update to 4.10.7
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.15, 6.4.0.4
Maximo Application Suite - IoT Component - addressed in versions 8.7.26, 8.8.22, 9.0.12, 9.1.3
IBM OpenPages with Watson - addressed in versions 9.0.0.5.7, 9.1.2.1

• https://spring.io/security/cve-2025-41248

• Information disclosure in Spring Security
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4.10
• Multiple vulnerabilities in IBM OpenPages for Cloud Pak for Data
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM OpenPages
• Confluence Data Center and Server update for Spring Security
• Bitbucket Data Center and Server update for Spring Security
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in IBM Observability with Instana
• Jira Software Data Center and Server update for Pivotal Spring Framework
• Multiple vulnerabilities in IBM Netezza Appliance
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge
• Jira Service Management Data Center and Server update for spring-security-core
• Crowd Data Center update for spring-security-core
• Multiple vulnerabilities in IBM Library Support for Spring
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in Oracle WebCenter Sites
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM DB2 Data Management Console
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Rational Build Forge
• Multiple vulnerabilities in IBM DevOps Build
• Multiple vulnerabilities in IBM Control Center
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Oracle Banking Branch
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in IBM Sterling B2B Integrator and IBM Sterling File Gateway
• Multiple vulnerabilities in IBM Storage Defender Copy Data Management
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition