Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-11272

CVE-2019-11272: Insufficiently Protected Credentials and Improper Authentication in Spring Security

7.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2019-11272
GHSA ID
GHSA-v33x-prhc-gph5
EPSS Score
0.60355%
CWE
CWE-287
Published
6/27/2019
Updated
1/28/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.springframework.security:spring-security-coremaven<= 4.2.124.2.13
org.springframework.security:spring-security-casmaven<= 4.2.12.RELEASE4.2.13.RELEASE

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from PlaintextPasswordEncoder's matches() method handling of null encoded passwords. The CVE description explicitly states authentication succeeds with 'null' password when encoded password is null. The matches() method is the core authentication comparison point in password encoders, making it the direct vulnerable function. While no patch diffs are available, the CVE details and Spring Security architecture confirm this is the only function that performs the insecure credential comparison.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Sprin* S**urity, v*rsions *.*.x up to *.*.**, *n* ol**r unsupport** v*rsions support pl*in t*xt p*sswor*s usin* Pl*int*xtP*sswor**n*o**r. I* *n *ppli**tion usin* *n *****t** v*rsion o* Sprin* S**urity is l*v*r**in* Pl*int*xtP*sswor**n*o**r *n* * us*r

Reasoning

T** vuln*r**ility st*ms *rom `Pl*int*xtP*sswor**n*o**r`'s `m*t***s()` m*t*o* **n*lin* o* null *n*o*** p*sswor*s. T** *V* **s*ription *xpli*itly st*t*s *ut**nti**tion su*****s wit* 'null' p*sswor* w**n *n*o*** p*sswor* is null. T** `m*t***s()` m*t*o*