CVE-2024-38810

Missing Authorization When Using @AuthorizeReturnObject PUBLISHED

Description (CNA)

Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.

Affected (CNA)

Vendor / product	Versions
spring / spring security	affected 6.3.x before 6.3.2

CWE

CWE-287

References

https://spring.io/security/cve-2024-38810

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.