CVE-2016-9879

CWE-417CWE-20 — Improper Input Validation7 documents6 sources
Severity
7.5HIGH
EPSS
0.3%
top 44.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Websphere Application ServerVmware Spring Security
Timeline
PublishedJan 6
Latest updateSep 15

Description

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶Mavenorg.springframework.security:spring-security-core4.0.0.RELEASE — 4.1.4.RELEASE+2
▶NVDvmware/spring_security15 versions+14

🔴Vulnerability Details

3
GHSA
Security Constraint Bypass in Spring Security↗2020-09-15
▶
OSV
Security Constraint Bypass in Spring Security↗2020-09-15
▶
CVEList
CVE-2016-9879: An issue was discovered in Pivotal Spring Security before 3↗2017-01-06
▶

📋Vendor Advisories

1
Red Hat
Security: Improper handling of path parameters allows bypassing the security constraint↗2016-12-28
▶

💬Community

2
Bugzilla
CVE-2016-9879 springframework-security: Spring Security: Improper handling of path parameters allows bypassing the security constraint [fedora-all]↗2017-01-03
▶
Bugzilla
CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint↗2017-01-03
▶
CVE-2016-9879 (HIGH CVSS 7.5) | An issue was discovered in Pivotal | cvebase.io