CVE-2025-41248
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-09-16
Assigner: VMware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| spring | spring_security | 6.4.2 |
| spring | spring_security | 6.5.1 |
| spring | spring_security | 6.4.9 |
| spring | spring_security | 6.5.4 |
| spring | spring_security | 6.4.4 |
| spring | spring_security | 6.4.10 |
| spring | spring_security | 6.4.7 |
| spring | spring_security | 6.5.3 |
| spring | spring_security | 6.4.5 |
| spring | spring_security | 6.5.2 |
| spring | spring_security | 6.4.8 |
| spring | spring_security | 6.4.0 |
| spring | spring_security | 6.4.1 |
| spring | spring_security | 6.4.6 |
| spring | spring_security | 6.5.0 |
| spring | spring_security | 6.4.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-289 | The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Spring Security occurs because the annotation detection mechanism fails to correctly resolve security annotations like @PreAuthorize on methods within type hierarchies that use parameterized super types with unbounded generics. This flaw can cause an authorization bypass when using the @EnableMethodSecurity feature, allowing unauthorized users to access secured methods. [1]
How can this vulnerability impact me? :
If your application uses Spring Security's @EnableMethodSecurity feature and applies security annotations on methods declared in generic superclasses or interfaces, this vulnerability can allow unauthorized users to bypass authorization controls and access secured methods. If you do not use these configurations, you are not affected. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Spring Security to version 6.4.10 or later if you are using the 6.4.x branch, or to version 6.5.4 or later if you are using the 6.5.x branch. If upgrading is not possible, as a workaround, declare all secured target methods directly in their concrete target classes instead of in generic superclasses or interfaces. No additional mitigation steps are required. [1]