CVE-2019-11272
PlaintextPasswordEncoder authenticates encoded passwords that are null
HIGH 7.3
At a glance
- Source
- NVD
- EPSS
- EPSS 1.38 % · percentile 72 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- pivotal
- NVD status
- Analyzed
Description
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-v33x-prhc-gph5 — Insufficiently Protected Credentials and Improper Authentication in Spring Security
European references
- ENISA EUVD · EUVD-2019-0562
- GCVE · GCVE-0-2019-11272
Affected configurations (NVD CPE)
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*< 4.2.13cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Spring · Spring Security | affected 4.2 < 4.2.13.RELEASE |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |