Detections
Analytics
SCA: security update for org.springframework.security:spring-security-core (GHSA-wmv4-5w76-vp9g)
critical Tenable Cloud Security Plugin ID 420011
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service
could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to
the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is
populated based upon untrusted information within the HTTP request. This means if there are access control
restrictions on which CAS services can authenticate to one another, those restrictions can be bypassed. If
users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service,
then there is no impact to users. (CVE-2014-3527)
See Also
Plugin Details
Severity: Critical
ID: 420011
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 6/30/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.15
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2014-3527
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 9/15/2020
Vulnerability Publication Date: 8/17/2014
Reference Information
CVE: CVE-2014-3527
BID: 69495
cwe: CWE-287