Information Exposure Affecting org.springframework.security:spring-security-core package, versions [,2.0.8.RELEASE) [3.0.0.RELEASE,3.0.8.RELEASE) [3.1.0.RELEASE,3.1.3.RELEASE)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-30174
- published 25 Dec 2016
- disclosed 5 Dec 2012
- credit Nicholas Goodwin
Introduced: 5 Dec 2012
CVE-2012-5055 Open this link in a new tabHow to fix?
Upgrade org.springframework.security:spring-security-core to version 2.0.8.RELEASE, 3.0.8.RELEASE, 3.1.3.RELEASE or higher.
Overview
org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform.
Affected versions of this package are vulnerable to Information Exposure. DaoAuthenticationProvider in VMware SpringSource Spring Security does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.