Permissions, Privileges, and Access Controls in Spring Framework and Spring Security - CVE-2016-5007

Vulnerability identifier: #VU82532

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-5007

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to both Spring Security and the Spring Framework rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. A remote attacker can trigger the vulnerability to bypass security restrictions.

Spring Framework
Spring Security
IBM SPSS Collaboration and Deployment Services
openEuler
springframework
springframework-help
springframework-context
springframework-expression
springframework-aop
springframework-web
springframework-tx
springframework-orm
springframework-beans
springframework-orm-hibernate4
springframework-jdbc
springframework-instrument
springframework-oxm
springframework-jms
Storage Copy Data Management
IBM Engineering Requirements Management DOORS Next

Install updates from vendor's website.

springframework - update to 3.2.18-8
springframework-help - update to 3.2.18-8
springframework-context - update to 3.2.18-8
springframework-expression - update to 3.2.18-8
springframework-aop - update to 3.2.18-8
springframework-web - update to 3.2.18-8
springframework-tx - update to 3.2.18-8
springframework-orm - update to 3.2.18-8
springframework-beans - update to 3.2.18-8
springframework-orm-hibernate4 - update to 3.2.18-8
springframework-jdbc - update to 3.2.18-8
springframework-instrument - update to 3.2.18-8
springframework-oxm - update to 3.2.18-8
springframework-jms - update to 3.2.18-8
Storage Copy Data Management - update to 2.2.26.0
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.7

• https://pivotal.io/security/cve-2016-5007
• http://www.securityfocus.com/bid/91687
• http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• openEuler update for springframework
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services