DeutschShown in its original language — a full translation is planned for a future version.
VMware Tanzu Spring Security: Mehrere Schwachstellen
view advisory published 2026-08-20
Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Security ausnutzen, um Dateien zu manipulieren, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-59277US | medium5.3 | — | ||
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as bel… | ||||
| CVE-2026-59276US | — | — | ||
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equa… | ||||
| CVE-2026-59270US | critical9.1OT elevated | — | ||
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfa… | ||||
| CVE-2026-47877US | medium6.1 | — | ||
Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6 | ||||
| CVE-2026-47842US | — | — | ||
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (al… | ||||
| CVE-2026-47841US | —OT elevated | — | ||
An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store.
Spring Security 7.1.0
Spring Secu… | ||||
| CVE-2026-41707US | —OT elevated | — | ||
Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerabili… | ||||
02
references
External citations — patches, advisories, analysis.
- Spring Security Advisory CVE-2026-41707 vom 2026-08-20external
- Spring Security Advisory CVE-2026-47841 vom 2026-08-20external
- Spring Security Advisory CVE-2026-47842 vom 2026-08-20external
- Spring Security Advisory CVE-2026-47877 vom 2026-08-20external
- Spring Security Advisory CVE-2026-59270 vom 2026-08-20external
- Spring Security Advisory CVE-2026-59276 vom 2026-08-20external
- Spring Security Advisory CVE-2026-59277 vom 2026-08-20external
- WID-SEC-W-2026-2956 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan