CVE-2024-22234

A vulnerability was found in Spring Security. This issue may lead to Broken Access Control, allowing a malicious user to impact the Confidentiality and Integrity of an application or server. This requires the application to use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and have a null authentication parameter passed to it, resulting in an erroneous true return value.

Red Hat considers this as a Moderate impact since it requires the malicious user to have knowledge of how a server implements the authentication resolver from Spring Security. A validation is also suggested to make sure there are no null parameters and no erroneous true is triggered from this method.

An application is not vulnerable if any of the following are true:

• The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly
• The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated
• The application only uses isFullyAuthenticated via Method Security or HTTP Request Security

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Make sure the application is not vulnerable according to the description bullet points mentioned in this page.