Authorization Bypass of Static Resources in WebFlux Applications (Spring Spring)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.74 % · percentile 78 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- vmware
- NVD status
- Deferred
Description
Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support
Weaknesses (CWE)
- CWE-770 — Allocation of Resources Without Limits or Throttling
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | vmware |
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | NVD · security@vmware.com (Secondary) |
Advisories
- GHSA-c4q5-6c82-3qpw — Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications
European references
- ENISA EUVD · EUVD-2024-3011
- GCVE · GCVE-0-2024-38821
CERT-FR advisories
- CERTFR-2025-AVI-1131 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0924 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0215 — Multiples vulnérabilités dans VMware Tanzu Gemfire · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0914 — Vulnérabilité dans les produits Spring · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Spring · Spring | affected 5.7.x < 5.7.13 ; affected 5.8.x < 5.8.15 ; affected 6.0.x < 6.0.13 ; affected 6.1.x < 6.1.11 ; affected 6.2.x < 6.2.7 ; affected 6.3.x < 6.3.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |