spring-security-config-4.0.2.RELEASE.jar: 1 vulnerabilities (highest severity is: 8.7) [vp-rem] (reachable)

[mend-developer-platform-dev]

📂 Vulnerable Library - spring-security-config-4.0.2.RELEASE.jar

spring-security-config

Library home page: http://spring.io/spring-security

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-config/4.0.2.RELEASE/spring-security-config-4.0.2.RELEASE.jar

Findings

Finding	Severity	🎯 CVSS	Exploit Maturity	EPSS	Library	Type	Fixed in	Remediation Available	Reachability
CVE-2016-5007	🔴 High	8.7	Not Defined	< 1%	spring-security-config-4.0.2.RELEASE.jar	Direct	org.springframework:spring-webmvc:4.3.0.RELEASE,org.springframework.security:spring-security-web:4.1.1.RELEASE,org.springframework.security:spring-security-config:4.1.1.RELEASE	✅	Reachable

Details

🔴CVE-2016-5007

Vulnerable Library - spring-security-config-4.0.2.RELEASE.jar

spring-security-config

Library home page: http://spring.io/spring-security

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-config/4.0.2.RELEASE/spring-security-config-4.0.2.RELEASE.jar

Dependency Hierarchy:

• ❌ spring-security-config-4.0.2.RELEASE.jar (Vulnerable Library)

---

Reachability Analysis

This vulnerability is potentially reachable:

- com.visualpathit.account.service.UserDetailsServiceImpl (Application)
    - org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter$UserDetailsServiceDelegator (Extension)
        - org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter (Extension)
            - org.springframework.security.config.annotation.web.builders.WebSecurity (Extension)
                -> ❌ org.springframework.security.config.annotation.web.builders.WebSecurity$IgnoredRequestConfigurer (Vulnerable Component)

---

Vulnerability Details

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

Publish Date: May 25, 2017 05:00 PM

URL: CVE-2016-5007

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

---

Suggested Fix

Type: Upgrade version

Origin: https://pivotal.io/security/cve-2016-5007

Release Date: May 25, 2017 05:00 PM

Fix Resolution : org.springframework:spring-webmvc:4.3.0.RELEASE,org.springframework.security:spring-security-web:4.1.1.RELEASE,org.springframework.security:spring-security-config:4.1.1.RELEASE