CVE-2016-5007

CWE-264CWE-4110 documents7 sources
Severity
7.5HIGH
EPSS
0.2%
top 63.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Pivotal Spring FrameworkPivotal Spring SecurityPivotal Software Spring Framework+2 more
Timeline
PublishedMay 25
Latest updateOct 17

Description

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by t…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages8 packages

▶NVDvmware/spring_security17 versions+16
▶CVEListV5pivotal/spring_security3.2.x, 4.0.x, 4.1.0+2
▶NVDvmware/spring_framework45 versions+44

🔴Vulnerability Details

4
GHSA
Spring Security and Spring Framework may not recognize certain paths that should be protected↗2018-10-17
▶
OSV
Spring Security and Spring Framework may not recognize certain paths that should be protected↗2018-10-17
▶
CVEList
CVE-2016-5007: Both Spring Security 3↗2017-05-25
▶
OSV
CVE-2016-5007: Both Spring Security 3↗2017-05-25
▶

📋Vendor Advisories

2
Red Hat
spring: Path matching inconsistency↗2016-07-07
▶
Debian
CVE-2016-5007: libspring-java - Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, ...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-5007 springframework: spring: Path matching inconsistency [fedora-all]↗2016-07-08
▶
Bugzilla
CVE-2016-5007 springframework-security: spring: Path matching inconsistency [fedora-all]↗2016-07-08
▶
Bugzilla
CVE-2016-5007 spring: Path matching inconsistency↗2016-07-08
▶
CVE-2016-5007 (HIGH CVSS 7.5) | Both Spring Security 3.2.x | cvebase.io