Authorization Bypass SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-8399278

[github-actions]

Overview

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authorization Bypass due to the use of String.toLowerCase() and String.toUpperCase() that have Locale dependent exceptions, which results in authorization rules not working properly.

Remediation

Upgrade org.springframework.security:spring-security-web to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Spring Security Advisory