VIR Vulnerability Intelligence Relay

CVE-2014-3527

critical
Published 2017-05-25 · Modified 2024-04-16
CVSS v3
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2
7.5
VIR risk
9.8

Description

Authorization Bypass in Spring Security

Predictions

Exploit likelihood
97%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security_alert@emc.com — https://pivotal.io/security/cve-2014-3527

Package impact
EcosystemPackageVulnerableFixed
java Mavenorg.springframework.security:spring-security-core<3.1.73.1.7
java Mavenorg.springframework.security:spring-security-core>=3.2.0,<3.2.53.2.5

Application impact
VendorProductVersionsFixed
vmwarespring_security3.1.0
vmwarespring_security3.1.1
vmwarespring_security3.1.2
vmwarespring_security3.1.3
vmwarespring_security3.1.4
vmwarespring_security3.2.0
vmwarespring_security3.2.1
vmwarespring_security3.2.2
vmwarespring_security3.2.3
vmwarespring_security3.2.4

References

CWEs

CWE-287

Verify integrity in audit chain (admin only). AS-IS.