Log in Start free

Vulnerability · Published May 14, 2020 · Assigned by pivotal

CVE-2020-5408Dictionary attack with Spring Security queryable text encryptor

Medium 6.5

In plain English

A medium-severity security flaw in Spring Security from Spring by VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)1.6%top 24.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.springframework.security:spring-security-core5.3.2GHSA-2ppp-9496-p23q
Mavenorg.springframework.security:spring-security-core5.2.4GHSA-2ppp-9496-p23q
Mavenorg.springframework.security:spring-security-core5.1.10GHSA-2ppp-9496-p23q
Mavenorg.springframework.security:spring-security-core5.0.16GHSA-2ppp-9496-p23q
Mavenorg.springframework.security:spring-security-core4.2.16GHSA-2ppp-9496-p23q

Affected products (as reported)

VendorProductVersions
Spring by VMware Spring Security 4.2 – before 4.2.165.0 – before 5.0.165.1 – before 5.1.105.2 – before 5.2.45.3 – before 5.3.2

Weakness: CWE-329

References