CVE-2024-38810

Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.

Score

CVSS 3.1 7.5 High

Status

Analyzed - security@vmware.com

Published

2024-08-20

Last modified

2024-08-20

Weaknesses

CWE-287, CWE-862

Affected products

• Spring Security (Spring)
• Spring Security (Vmware)

References

• https://spring.io/security/cve-2024-38810