This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] VMware Spring Security fixes two vulnerabilities
VMware fixes two vulnerabilities in Spring Security with versions 5.7.16, 5.8.18, 6.0.16, 6.1.14, 6.2.10, 6.3.8 and 6.4.4 [1][2].
An unauthenticated remote attacker can bypass password verification in a tool using BCryptPasswordEncoder.matches(CharSequence, String) if the supplied password exceeds 72 characters and the first 72 characters match [1].
The vulnerability is present in product:
- *:Spring Security; >=5.7.0, <=5.7.15; >=5.8.0, <=5.8.17; >=6.0.0, <=6.0.15; >=6.1.0, <=6.1.13; >=6.2.0, <=6.2.9; >=6.3.0, <=6.3.7; >=6.4.0, <=6.4.3
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2025-22228 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 19. 3. 2025.
An unauthenticated remote attacker can bypass authorization in Spring Security and call protected methods if the application uses @EnableMethodSecurity and security annotations are not applied directly to the target methods [2].
The vulnerability is present in product:
- *:Spring Security; >=6.4.0, <=6.4.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2025-22223 at cve.org, NVD
- CWE-281: Improper Preservation of Permissions at cwe.mitre.org
The vulnerability was publicly disclosed 19. 3. 2025.
By CESNET, z.s.p.o. Michaela Jarošová on 21. 3. 2025.