← CVE Intelligence

CVE-2024-38821

Authorization Bypass of Static Resources in WebFlux Applications PUBLISHED

Description (CNA)

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support

Affected (CNA)

Vendor / productVersions
Spring / Springaffected 5.7.x before 5.7.13; affected 5.8.x before 5.8.15; affected 6.0.x before 6.0.13; affected 6.1.x before 6.1.11; affected 6.2.x before 6.2.7; affected 6.3.x before 6.3.4

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.