Improper access control in Spring Security - CVE-2024-22234

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU86694

Improper access control in Spring Security - CVE-2024-22234

Published: February 21, 2024


Vulnerability identifier: #VU86694
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-22234
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions within the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. A remote user can bypass implemented security restrictions and gain unauthorized access to the application.


Affected software

Spring Security
Cloud Pak for Security (CP4S)
QRadar Suite
Oracle Communications Cloud Native Core Policy
Cloud Pak for Network Automation
Dell Policy Manager for Secure Connect Gateway (SCG)
Red Hat OpenShift Dev Spaces

How to mitigate CVE-2024-22234

Install updates from vendor's website.

Spring Security - addressed in versions 6.1.7, 6.2.2
QRadar Suite - update to 1.10.20.0
Cloud Pak for Network Automation - update to 2.7.5
Red Hat OpenShift Dev Spaces - update to 3.16.0
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.24.00.14

External References

Related Security Bulletins