Description (CNA)
Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Spring / Spring Security | affected 7.0.0 through 7.0.4 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in Spring Security. This vulnerability allows a remote attacker to impersonate another user. The SubjectX500PrincipalExtractor component incorrectly handles certain malformed X.509 certificate Common Name (CN) values, which can lead to the system reading an incorrect username. By presenting a carefully crafted certificate, an attacker can exploit this to gain unauthorized access.