Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2024-38821

Authorization Bypass of Static Resources in WebFlux Applications

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring

Default version status: affected

  • 5.7.x to < 5.7.13affected
  • 5.8.x to < 5.8.15affected
  • 6.0.x to < 6.0.13affected
  • 6.1.x to < 6.1.11affected
  • 6.2.x to < 6.2.7affected
  • 6.3.x to < 6.3.4affected

References