Detections
Analytics

SCA: security update for org.springframework.security:spring-security-core, org.springframework:spring-core (GHSA-8crv-49fr-2h6j)

high Tenable Cloud Security Plugin ID 422849

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL
 pattern mappings for authorization and for mapping requests to controllers respectively. Differences in
 the strictness of the pattern matching mechanisms, for example with regards to space trimming in path
 segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped
 to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring
 Framework provides richer features with regards to pattern matching as well as by the fact that pattern
 matching in each Spring Security and the Spring Framework can easily be customized creating additional
 differences. (CVE-2016-5007)

See Also

https://github.com/advisories/GHSA-8crv-49fr-2h6j

Plugin Details

Severity: High

ID: 422849

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 3/29/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.7

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2016-5007

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/17/2018

Vulnerability Publication Date: 7/7/2016

Reference Information

CVE: CVE-2016-5007

BID: 91687