Authorization Bypass SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-8399269

[github-actions]

Overview

org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authorization Bypass due to the use of String.toLowerCase() and String.toUpperCase() that have Locale dependent exceptions, which results in authorization rules not working properly.

Remediation

Upgrade org.springframework.security:spring-security-core to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Spring Security Advisory