-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from RegexRequestMatcher's URL construction and matching logic. The matches() method combines servletPath, pathInfo, and queryString directly, creating potential mismatches between the regex pattern and actual processed URLs in some containers. When patterns contain '.' (which matches any character in regex), attackers could bypass security checks using alternative URL encodings or path normalization. The CVE description explicitly implicates RegexRequestMatcher with '.' in regular expressions, and the class's source code shows the vulnerable URL construction pattern in the matches() method.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.springframework.security:spring-security-core | maven | >= 5.6.0, < 5.6.4 | 5.6.4 |
| org.springframework.security:spring-security-core | maven | >= 5.5.0, < 5.5.7 | 5.5.7 |
| org.springframework.security:spring-security-core | maven | < 5.4.11 | 5.4.11 |
| org.springframework.security:spring-security-web | maven | >= 5.5.0, < 5.5.7 | 5.5.7 |
| org.springframework.security:spring-security-web | maven | >= 5.6.0, < 5.6.4 | 5.6.4 |
| org.springframework.security:spring-security-web | maven | < 5.4.11 | 5.4.11 |