Spring Framework CVE-2018-1258 – Security Authentication Bypass

Authors:Spring Security Team    Risk:Critical

CVE:CVE-2018-1258              0day:Security Authentication Bypass 

0day -id:0DAY-176186            Date:2018-05-15

Description

Spring Security in combination with Spring Framework 5.0.5.RELEASE contain an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

Affected Pivotal Products and Versions

Severity is critical unless otherwise noted.

  • Spring Framework 5.0.5.RELEASE + Spring Security (any version)

Mitigation

  • Users leveraging Spring Security’s method security should ensure they are using Spring Framework 5.0.6.RELEASE or newer. Updating to Spring Security 5.0.5.RELEASE+ or Spring Boot 2.0.2.RELEASE+ brings in Spring Framework 5.0.6.RELEASE transitively. However, users should be certain that other dependency management mechanisms are also updated to use Spring Framework 5.0.6.RELEASE or newer.
  • There are no other mitigation steps required.

Credit

This issue was identified internally by the Spring Security Team.

Leave a Reply