CVE-2019-11272: PlaintextPasswordEncoder authenticates encoded passwords that are null
A flaw was found in Spring Security in several versions, in the use of plain text passwords using the PlaintextPasswordEncoder. If an application is using an affected version of Spring Security with the PlaintextPasswordEncoder and a user has a null encoded password, an attacker can use this flaw to authenticate using a password of "null."
Other sources
Pivotal Spring Security could allow a remote attacker to bypass security restrictions, caused by a flaw in the PlaintextPasswordEncoder function. By using a password of "null", an attacker could exploit this vulnerability to bypass access restrictions.
— IBM
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-11272?
CVE-2019-11272 is a vulnerability in Pivotal Spring Security that could allow a remote attacker to bypass security restrictions caused by a plain text password.
What versions of Spring Security are affected by CVE-2019-11272?
Spring Security versions 4.2.x up to 4.2.12, and older unsupported versions are affected by CVE-2019-11272.
How can a remote attacker exploit CVE-2019-11272?
A remote attacker can exploit CVE-2019-11272 by leveraging a null encoded password when an application is using the affected version of Spring Security with PlaintextPasswordEncoder.
What is the severity of CVE-2019-11272?
CVE-2019-11272 has a severity rating of 7.3 (high).
How can I fix CVE-2019-11272?
To fix CVE-2019-11272, it is recommended to upgrade to a patched version of Spring Security (4.2.13 or later) or apply the necessary security updates provided by the vendor.