CVE-2024-22234

描述

In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. Specifically, an application is vulnerable if: * The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value. An application is not vulnerable if any of the following is true: * The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly. * The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated * The application only uses isFullyAuthenticated via Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html

如何修補 CVE-2024-22234

要修補 CVE-2024-22234,請將受影響套件升級到下列已修補版本。

• —升級至 6.1.7 或更新版本

CVE-2024-22234 正在被利用嗎?

低 — EPSS 為 0.7%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 6.1.0, < 6.1.7

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-22234
• PATCHgithub.com/spring-projects/spring-security
• WEBgithub.com/spring-projects/spring-security/commit/750cb30ce44d279c2f54c845d375e6a58bded569
• WEBsecurity.netapp.com/advisory/ntap-20240315-0003