In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.6.1.1 prior or equal to 9.6.1.13 or 9.7.2.1 prior or equal to 9.7.2.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 7279145 advisory.

  - IBM DOORS Web Access do not limit the length of a connection which could allow for a Slowloris HTTP denial     of service attack to take place. This can cause the web server to become unresponsive. (CVE-2024-25039)

  - IBM DOORS Web Access is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated     attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality     potentially leading to credentials disclosure within a trusted session. (CVE-2025-0152)

  - IBM DOORS Web Access could allow a remote attacker to obtain sensitive information when a detailed     technical error message is returned in the browser. This information could be used in further attacks     against the system. (CVE-2020-4984)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9,
    versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to
    broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication
    parameter. (CVE-2024-22257)

The versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2024 CPU advisory.

  - Vulnerability in the MySQL Enterprise Monitor component Spring Security. A remote     unauthenticated attacker could gain unauthorized access to critical data or complete     access to all MySQL Enterprise Monitor accessible data as well as unauthorized     update, insert or delete access to some of MySQL Enterprise Monitor accessible data.     (CVE-2024-22257)

  - Vulnerability in the MySQL Enterprise Monitor component Spring     Framework. Supported versions that are affected are 8.0.38 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols     to compromise MySQL Enterprise Monitor. Successful attacks require human interaction from     a person other than the attacker. Successful attacks of this vulnerability can result     in unauthorized creation, deletion or modification access to critical data or all MySQL     Enterprise Monitor accessible data as well as unauthorized access to critical data or     complete access to all MySQL Enterprise Monitor accessible data. (CVE-2024-22262)

  - Vulnerability in the MySQL Enterprise Monitor component     Apache Tomcat. A unauthenticated attacker with network access via multiple protocols     to compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash MySQL     Enterprise Monitor. (CVE-2024-24549)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-95840 advisory.

  - In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9,     versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to     broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication     parameter. (CVE-2024-22257)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-15307 advisory.

  - In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9,     versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to     broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication     parameter. (CVE-2024-22257)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
333335	IBM Engineering Requirements Management DOORS 9.6.1.1 <= 9.6.1.13 / 9.7.2.1 < 9.7.2.11 Multiple Vulnerabilities (7279145)	Nessus	Windows	Local	high
414229	SCA: security update for org.springframework.security:spring-security-core (GHSA-f3jh-qvm4-mg39)	Tenable Cloud Security	SCA Checks	Local	high
414229	SCA: security update for org.springframework.security:spring-security-core (GHSA-f3jh-qvm4-mg39)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
202597	Oracle MySQL Enterprise Monitor (Jul 2024 CPU)	Nessus	CGI abuses	Combined	high
201089	Atlassian Confluence 1.0.1 < 7.19.22 / 7.20.x < 8.5.9 / 8.6.x < 8.9.1 (CONFSERVER-95840)	Nessus	CGI abuses	Combined	high
197935	Atlassian Jira Service Management Data Center and Server < 5.4.20 / 5.5.x < 5.12.7 / 5.13.x < 5.15.2 Broken Access Control (JSDSERVER-15307)	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2024-22257

high

Tenable Plugins

high

high

high

high

high

high