SB2025040845 - Improper authorization in Spring Cloud Config

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025040845

SB2025040845 - Improper authorization in Spring Cloud Config

Published: April 8, 2025

Security Bulletin ID SB2025040845
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper authorization (CVE-ID: CVE-2025-22232)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an error when handling Vault tokens sent via the X-CONFIG-TOKEN header, as the application may not use Vault token sent by the client. The SessionManager persists the first token it retrieves and will continue to use that token even if client requests to the Spring Cloud Config Server include a X-CONFIG-TOKEN header with a different value. A remote attacker can bypass authorization checks and gain unauthorized access to the application.


Remediation

Install update from vendor's website.

References