-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe JFrog blog post provides a detailed analysis of the vulnerability and the fix. It explicitly mentions the PathPatternParserServerWebExchangeMatcher.java file and the parse() method as the location of the vulnerability. The explanation of how the initFullPathPattern() method was introduced in the fix to correctly handle patterns confirms that the original parse() method was the source of the issue. Although direct commit information was not available through the tool, the blog post's analysis of the commit is sufficiently detailed to identify the vulnerable function with high confidence.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.springframework.security:spring-security-config | maven | >= 5.6.0, < 5.6.12 | 5.6.12 |
| org.springframework.security:spring-security-config | maven | >= 5.7.0, < 5.7.10 | 5.7.10 |
| org.springframework.security:spring-security-config | maven | >= 5.8.0, < 5.8.5 | 5.8.5 |
| org.springframework.security:spring-security-config | maven | >= 6.0.0, < 6.0.5 | 6.0.5 |
| org.springframework.security:spring-security-config | maven | >= 6.1.0, < 6.1.2 | 6.1.2 |
Ongoing coverage of React2Shell