Spring Framework Constraint Bypass: HTTP Method Substring Bypass in @ConstraintViolation

Vulnerability Overview Vulnerability Name: Constraint bypass when using an HTTP method name that is a substring of an http-method-omission Description: When using the annotation, a constraint bypass occurs if the HTTP method name is a substring of an . This allows attackers to bypass certain security constraints. Affected Scope: Affected Versions: 1.2.2.0 - 1.2.2.28, 1.2.3.0 - 1.2.3.12, 1.2.4.0 - 1.2.4.11, 1.2.5.0 - 1.2.5.12, 1.2.6.0 - 1.2.6.12, 1.2.7.0 - 1.2.7.12, 1.2.8.0 - 1.2.8.12, 1.2.9.0 - 1.2.9.12, 1.3.0.0 - 1.3.0.12, 1.3.1.0 - 1.3.1.12, 1.3.2.0 - 1.3.2.12, 1.3.3.0 - 1.3.3.12, 1.3.4.0 - 1.3.4.12, 1.3.5.0 - 1.3.5.12, 1.3.6.0 - 1.3.6.12, 1.3.7.0 - 1.3.7.12, 1.3.8.0 - 1.3.8.12, 1.3.9.0 - 1.3.9.12, 1.4.0.0 - 1.4.0.12, 1.4.1.0 - 1.4.1.12, 1.4.2.0 - 1.4.2.12, 1.4.3.0 - 1.4.3.12, 1.4.4.0 - 1.4.4.12, 1.4.5.0 - 1.4.5.12, 1.4.6.0 - 1.4.6.12, 1.4.7.0 - 1.4.7.12, 1.4.8.0 - 1.4.8.12, 1.4.9.0 - 1.4.9.12, 1.5.0.0 - 1.5.0.12, 1.5.1.0 - 1.5.1.12, 1.5.2.0 - 1.5.2.12, 1.5.3.0 - 1.5.3.12, 1.5.4.0 - 1.5.4.12, 1.5.5.0 - 1.5.5.12, 1.5.6.0 - 1.5.6.12, 1.5.7.0 - 1.5.7.12, 1.5.8.0 - 1.5.8.12, 1.5.9.0 - 1.5.9.12, 1.6.0.0 - 1.6.0.12, 1.6.1.0 - 1.6.1.12, 1.6.2.0 - 1.6.2.12, 1.6.3.0 - 1.6.3.12, 1.6.4.0 - 1.6.4.12, 1.6.5.0 - 1.6.5.12, 1.6.6.0 - 1.6.6.12, 1.6.7.0 - 1.6.7.12, 1.6.8.0 - 1.6.8.12, 1.6.9.0 - 1.6.9.12, 1.7.0.0 - 1.7.0.12, 1.7.1.0 - 1.7.1.12, 1.7.2.0 - 1.7.2.12, 1.7.3.0 - 1.7.3.12, 1.7.4.0 - 1.7.4.12, 1.7.5.0 - 1.7.5.12, 1.7.6.0 - 1.7.6.12, 1.7.7.0 - 1.7.7.12, 1.7.8.0 - 1.7.8.12, 1.7.9.0 - 1.7.9.12, 1.8.0.0 - 1.8.0.12, 1.8.1.0 - 1.8.1.12, 1.8.2.0 - 1.8.2.12, 1.8.3.0 - 1.8.3.12, 1.8.4.0 - 1.8.4.12, 1.8.5.0 - 1.8.5.12, 1.8.6.0 - 1.8.6.12, 1.8.7.0 - 1.8.7.12, 1.8.8.0 - 1.8.8.12, 1.8.9.0 - 1.8.9.12, 1.9.0.0 - 1.9.0.12, 1.9.1.0 - 1.9.1.12, 1.9.2.0 - 1.9.2.12, 1.9.3.0 - 1.9.3.12, 1.9.4.0 - 1.9.4.12, 1.9.5.0 - 1.9.5.12, 1.9.6.0 - 1.9.6.12, 1.9.7.0 - 1.9.7.12, 1.9.8.0 - 1.9.8.12, 1.9.9.0 - 1.9.9.12, 1.10.0.0 - 1.10.0.12, 1.10.1.0 - 1.10.1.12, 1.10.2.0 - 1.10.2.12, 1.10.3.0 - 1.10.3.12, 1.10.4.0 - 1.10.4.12, 1.10.5.0 - 1.10.5.12, 1.10.6.0 - 1.10.6.12, 1.10.7.0 - 1.10.7.12, 1.10.8.0 - 1.10.8.12, 1.10.9.0 - 1.10.9.12, 1.11.0.0 - 1.11.0.12, 1.11.1.0 - 1.11.1.12, 1.11.2.0 - 1.11.2.12, 1.11.3.0 - 1.11.3.12, 1.11.4.0 - 1.11.4.12, 1.11.5.0 - 1.11.5.12, 1.11.6.0 - 1.11.6.12, 1.11.7.0 - 1.11.7.12, 1.11.8.0 - 1.11.8.12, 1.11.9.0 - 1.11.9.12, 1.12.0.0 - 1.12.0.12, 1.12.1.0 - 1.12.1.12, 1.12.2.0 - 1.12.2.12, 1.12.3.0 - 1.12.3.12, 1.12.4.0 - 1.12.4.12, 1.12.5.0 - 1.12.5.12, 1.12.6.0 - 1.12.6.12, 1.12.7.0 - 1.12.7.12, 1.12.8.0 - 1.12.8.12, 1.12.9.0 - 1.12.9.12, 1.13.0.0 - 1.13.0.12, 1.13.1.0 - 1.13.1.12, 1.13.2.0 - 1.13.2.12, 1.13.3.0 - 1.13.3.12, 1.13.4.0 - 1.13.4.12, 1.13.5.0 - 1.13.5.12, 1.13.6.0 - 1.13.6.12, 1.13.7.0 - 1.13.7.12, 1.13.8.0 - 1.13.8.12, 1.13.9.0 - 1.13.9.12, 1.14.0.0 - 1.14.0.12, 1.14.1.0 - 1.14.1.12, 1.14.2.0 - 1.14.2.12, 1.14.3.0 - 1.14.3.12, 1.14.4.0 - 1.14.4.12, 1.14.5.0 - 1.14.5.12, 1.14.6.0 - 1.14.6.12, 1.14.7.0 - 1.14.7.12, 1.14.8.0 - 1.14.8.12, 1.14.9.0 - 1.14.9.12, 1.15.0.0 - 1.15.0.12, 1.15.1.0 - 1.15.1.12, 1.15.2.0 - 1.15.2.12, 1.15.3.0 - 1.15.3.12, 1.15.4.0 - 1.15.4.12, 1.15.5.0 - 1.15.5.12, 1.15.6.0 - 1.15.6.12, 1.15.7.0 - 1.15.7.12, 1.15.8.0 - 1.15.8.12, 1.15.9.0 - 1.15.9.12, 1.16.0.0 - 1.16.0.12, 1.16.1.0 - 1.16.1.12, 1.16.2.0 - 1.16.2.12, 1.16.3.0 - 1.16.3.12, 1.16.4.0 - 1.16.4.12, 1.16.5.0 - 1.16.5.12, 1.16.6.0 - 1.16.6.12, 1.16.7.0 - 1.16.7.12, 1.16.8.0 - 1.16.8.12, 1.16.9.0 - 1.16.9.12, 1.17.0.0 - 1.17.0.12, 1.17.1.0 - 1.17.1.12, 1.17.2.0 - 1.17.2.12, 1.17.3.0 - 1.17.3.12, 1.17.4.0 - 1.17.4.12, 1.17.5.0 - 1.17.5.12, 1.17.6.0 - 1.17.6.12, 1.17.7.0 - 1.17.7.12, 1.17.8.0 - 1.17.8.12, 1.17.9.0 - 1.17.9.12, 1.18.0.0 - 1.18.0.12, 1.18.1.0 - 1.18.1.12, 1.18.2.0 - 1.18.2.12, 1.18.3.0 - 1.18.3.12, 1.18.4.0 - 1.18.4.12, 1.18.5.0 - 1.18.5.12, 1.18.6.0 - 1.18.6.12, 1.18.7.0 - 1.18.7.12, 1.18.8.0 - 1.18.8.12, 1.18.9.0 - 1.18.9.12, 1.19.0.0 - 1.19.0.12, 1.19.1.0 - 1.19.1.12, 1.19.2.0 - 1.19.2.12, 1.19.3.0 - 1.19.3.12, 1.19.4.0 - 1.19.4.12, 1.19.5.0 - 1.19.5.12, 1.19.6.0 - 1.19.6.12, 1.19.7.0 - 1.19.7.12, 1.19.8.0 - 1.19.8.12, 1.19.9.0 - 1.19.9.12, 1.20.0.0 - 1.20.0.12, 1.20.1.0 - 1.20.1.12, 1.20.2.0 - 1.20.2.12, 1.20.3.0 - 1.20.3.12, 1.20.4.0 - 1.20.4.12, 1.20.5.0 - 1.20.5.12, 1.20.6.0 - 1.20.6.12, 1.20.7.0 - 1.20.7.12, 1.20.8.0 - 1.20.8.12, 1.20.9.0 - 1.20.9.12, 1.21.0.0 - 1.21.0.12, 1.21.1.0 - 1.21.1.12, 1.21.2.0 - 1.21.2.12, 1.21.3.0 - 1.21.3.12, 1.21.4.0 - 1.21.4.12, 1.21.5.0 - 1.21.5.12, 1.21.6.0 - 1.21.6.12, 1.21.7.0 - 1.21.7.12, 1.21.8.0 - 1.21.8.12, 1.21.9.0 - 1.21.9.12, 1.22.0.0

Goal Reached Thanks to every supporter — we hit 100%!

Spring Framework Constraint Bypass: HTTP Method Substring Bypass in @ConstraintViolation

More from this source