What is GHSA-3533-rvpc-6x56?

GHSA-3533-rvpc-6x56 is a security advisory published by GitHub Security Advisories with Medium severity. Exposure of Sensitive Information to an Unauthorized Actor in Spring Security

Which CVE IDs does GHSA-3533-rvpc-6x56 cover?

GHSA-3533-rvpc-6x56 covers the following CVE IDs: CVE-2012-5055. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-3533-rvpc-6x56?

GHSA-3533-rvpc-6x56 affects 3 products, including: maven/org.springframework.security:spring-security-core:\u003c 2.0.8; maven/org.springframework.security:spring-security-core:\u003e= 3.0.0, \u003c 3.0.8; maven/org.springframework.security:spring-security-core:\u003e= 3.1.0, \u003c 3.1.3.

GHSA-3533-rvpc-6x56Medium

Exposure of Sensitive Information to an Unauthorized Actor in Spring Security

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2012-5055 →

📋 Description

DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.

🎯 Affected products3

maven/org.springframework.security:spring-security-core:< 2.0.8
maven/org.springframework.security:spring-security-core:>= 3.0.0, < 3.0.8
maven/org.springframework.security:spring-security-core:>= 3.1.0, < 3.1.3

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2012-5055
http://support.springsource.com/security/CVE-2012-5055
https://github.com/advisories/GHSA-3533-rvpc-6x56