CVE-2024-22257

HighCVSS 8.2/10Last modified Jun 30, 2026

Description

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Mar 18, 2024
Last modified: Jun 30, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-222586.1Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Do CVE-2024-222598.1Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perf CVE-2024-22265.4The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti CVE-2024-222606.8VMware Workspace One UEM update addresses an information exposure vulnerability. A malicious actor with network access to the Workspace One CVE-2024-222615.5SQL-Injection in Harbor allows priviledge users to leak the task IDs CVE-2024-222628.1Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation check CVE-2024-222638.8Spring Cloud Data Flow is a microservices-based Streaming and Batch data processing in Cloud Foundry and Kubernetes. The Skipper server has CVE-2024-222647.2VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious actor with admin privileges on VMware Avi Load Balancer CVE-2024-222666.5VMware Avi Load Balancer contains an information disclosure vulnerability. A malicious actor with access to the system logs can view cloud c CVE-2024-222678.2VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative p CVE-2024-222686.5VMware Workstation and Fusion contain a heap buffer-overflow vulnerability in the Shader functionality. A malicious actor with non-administr CVE-2024-222696.0VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device. A malicious actor with local adminis