Under Some Conditions Spring Security HTTP Headers Are not Written
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.5.9, 7.0.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 3 proofs of concept on GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers: : from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- VMware Spring Security
From 5.7.0 · through 5.7.21; From 5.8.0 · through 5.8.23; From 6.3.0 · through 6.3.14; From 6.4.0 · through 6.4.14; From 6.5.0 · through 6.5.8; From 7.0.0 · through 7.0.3
- org.springframework.security:spring-security-webMaven
through 5.7.14
- org.springframework.security:spring-security-webMaven
From 5.8.0 · through 5.8.16
- org.springframework.security:spring-security-webMaven
From 6.0.0 · through 6.3.10
- org.springframework.security:spring-security-webMaven
From 6.4.0 · through 6.4.13
- org.springframework.security:spring-security-webMaven
From 6.5.0 · fixed in 6.5.9
- org.springframework.security:spring-security-webMaven
From 7.0.0 · fixed in 7.0.4