CVE-2019-11272

CWE-287 — Improper AuthenticationCWE-522 — Insufficiently Protected CredentialsCWE-3056 documents6 sources
Severity
7.3HIGH
EPSS
0.4%
top 38.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Spring Spring SecurityVmware Spring SecurityDebian Debian Linux
Timeline
PublishedJun 26
Latest updateJul 11

Description

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 3.9 | Impact: 3.4

Affected Packages4 packages

▶CVEListV5spring/spring_security4.2 — 4.2.13.RELEASE

Also affects: Debian Linux 8.0

🔴Vulnerability Details

3
OSV
Insufficiently Protected Credentials and Improper Authentication in Spring Security↗2019-06-27
▶
GHSA
Insufficiently Protected Credentials and Improper Authentication in Spring Security↗2019-06-27
▶
CVEList
PlaintextPasswordEncoder authenticates encoded passwords that are null↗2019-06-26
▶

📋Vendor Advisories

1
Red Hat
spring-security-core: mishandling of user passwords allows logging in with a password of NULL↗2019-07-11
▶

💬Community

1
Bugzilla
CVE-2019-11272 spring-security-core: mishandling of user passwords allows logging in with a password of NULL↗2019-07-11
▶
CVE-2019-11272 (HIGH CVSS 7.3) | Spring Security | cvebase.io