SB2017052519 - Improper Authentication in VMware, Spring Security

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017052519

SB2017052519 - Improper Authentication in VMware, Spring Security

Published: May 25, 2017 Updated: August 8, 2020

Security Bulletin ID SB2017052519
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper Authentication (CVE-ID: CVE-2014-3527)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request. This means if there are access control restrictions on which CAS services can authenticate to one another, those restrictions can be bypassed. If users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service, then there is no impact to users.


Remediation

Install update from vendor's website.

References