Description (CNA)
Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Spring / Spring Security | affected 7.0.0 through 7.0.4 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in Spring Security. When an application uses `<sec:intercept-url>` to define authorization rules, the servlet path may not be correctly included in the path matcher. This oversight can lead to an authorization bypass, allowing a remote attacker to access protected resources without proper authentication or authorization.