Improper access control in Spring Security - CVE-2024-22234
Published: February 21, 2024
Vulnerability identifier: #VU86694
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2024-22234
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
Spring Security
Cloud Pak for Security (CP4S)
QRadar Suite
Oracle Communications Cloud Native Core Policy
Cloud Pak for Network Automation
Dell Policy Manager for Secure Connect Gateway (SCG)
Red Hat OpenShift Dev Spaces
Spring Security
Cloud Pak for Security (CP4S)
QRadar Suite
Oracle Communications Cloud Native Core Policy
Cloud Pak for Network Automation
Dell Policy Manager for Secure Connect Gateway (SCG)
Red Hat OpenShift Dev Spaces
Detailed vulnerability description
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions within the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. A remote user can bypass implemented security restrictions and gain unauthorized access to the application.
How to mitigate CVE-2024-22234
Install updates from vendor's website.