{"id":"CVE-2024-22257","title":"In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to \n5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, \nversions 6.2.x prior to 6.2.3, an application is possible vulnerable to \nbroken access control whe…","summary":"In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to \n5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, \nversions 6.2.x prior to 6.2.3, an application is possible vulnerable to \nbroken access control whe…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cwe":["CWE-862"],"published":"2024-03-18","updated":"2026-06-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-22257","references":[{"url":"https://security.netapp.com/advisory/ntap-20240419-0005/","label":"security@vmware.com"},{"url":"https://spring.io/security/cve-2024-22257","label":"security@vmware.com"},{"url":"https://github.com/dependency-check/DependencyCheck/issues/8642","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20240419-0005/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://spring.io/security/cve-2024-22257","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.00956,"epssPercentile":0.59736,"ingestedAt":"2026-06-30T13:26:50.066Z","slug":"CVE-2024-22257","body":"## Overview\n\nIn Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to \n5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, \nversions 6.2.x prior to 6.2.3, an application is possible vulnerable to \nbroken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}