CVE-2016-5007

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2016-5007
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5007.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-5007
Aliases
Related
Published
2017-05-25T17:29:00Z
Modified
2024-09-18T02:27:04.931453Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

References

Affected packages

Debian:11 / libspring-java

Package

Name
libspring-java
Purl
pkg:deb/debian/libspring-java?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / libspring-java

Package

Name
libspring-java
Purl
pkg:deb/debian/libspring-java?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / libspring-java

Package

Name
libspring-java
Purl
pkg:deb/debian/libspring-java?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/spring-projects/spring-security

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-security
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
001b05569af749a34daac9191014cf3e2658b018
Last affected
0065b55a7532668efc63abda3ba692ef0370bded
Last affected
081f0c4d946074d4e31c1b4dc795aa2cbacade46
Last affected
08e52898290911fd4c8bf98878ec1b919c337e15
Last affected
0e9d9da46b4cc62370bb8d7dd5b9744f300b6c4f
Last affected
19f88e91793342babf034e55d2f96cbba72c061a
Last affected
24fcb6c45a55333e5b856b6c73f14b68ceca0e19
Last affected
2d8b6650dbce667b2529cd594294b8fe991aaa3f
Last affected
3243a7cde216a9542ef7b6e6a18f5a7c6a1992b8
Last affected
325b814d492d63743ecd21a15b38651824568b1b
Last affected
33c9185160c91ffde53ff2c9da5420bd57420e48
Last affected
45421d63ac1c2259571371e781ba64cdea93dda9
Last affected
4619705e37fa49556480fb942247fb7b63727b3e
Last affected
48eb8788c4f077f1d0c9e2ba054d9443b0f6170d
Last affected
57ed7ddf3cbcd89d9c9c96c697b28e2a9be33858
Last affected
59bb10ef81dc0f1ceaeee8ab1c4d83344b924f90
Last affected
644392045ab256246bb2212b85054e584dc57b8e
Last affected
680facd4a81c4af2b10e606b964f84f6294e2c36
Last affected
6dc270383762fa3509792ce34843b76f3f22130c
Last affected
7a7ce11ebb9cb9337ca896f44da3d819639b5f56
Last affected
7f246e1c0e00e1eef15fe08664bddc4b18aa677a
Last affected
8e9f7e2f1055b5b4347b197e6d8a9fd660c62fad
Last affected
8f9065b3f6b48b9157b43b9e35153680d1bb68d7
Last affected
919f000c801be7bdc093d0cb6d89d99c94346ef8
Last affected
9287892863f77df4f29c53701e6fbf3fdc60a9a8
Last affected
98abd29c9feb67cc2a02cab1cd0f50f2306b7f1b
Last affected
9e8994a2b7b44a70dd877cb50b27eca496f2d315
Last affected
afcad4f0d48c9e4ca8abebcd08ebc3dc6194a6e9
Last affected
afe5ec53d48393113f4f10f69b76ce7ac12b348c
Last affected
d1669b909f79df09495d7015df74a163772259dd
Last affected
e0d95c7c8adb35476568d58d487bb6593e972a61
Last affected
e412fb7ac081c523450fc2da417325cf8dc45f42

Affected versions

1.*

1.0.0
1.0.2
1.0.3
1.0.4
1.0.5

2.*

2.5.0.M1

3.*

3.0.0.M2
3.0.0.RC2
3.0.1.RELEASE
3.0.2.RELEASE
3.1.0.M1
3.1.0.M2
3.1.0.RC1
3.1.0.RC2
3.1.0.RC3
3.1.0.RELEASE
3.1.1.RELEASE
3.1.2.RELEASE
3.1.3.RELEASE
3.2.0.M2
3.2.10.RELEASE

4.*

4.0.3.RELEASE
4.0.4.RELEASE
4.1.0.RC1
4.1.0.RC2
4.1.0.RELEASE