CVE-2025-41232

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

S

pring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: * You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and * You have Spring Security method annotations on a private method In that case, the target method may be able to be invoked without proper authorization. You are not affected if: * You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or * You have no Spring Security-annotated private methods

References

Link	Resource
http://spring.io/security/cve-2025-41232

Configurations

No configuration.

History

21 May 2025, 20:24

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-21 12:16

Updated : 2025-05-21 20:24

NVD link : CVE-2025-41232

Mitre link : CVE-2025-41232

CVE.ORG link : CVE-2025-41232

JSON object : View

Products Affected

No product.

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2025-41232", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2025-05-21T12:16:21.993", "references": [{"url": "http://spring.io/security/cve-2025-41232", "source": "[email protected]"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.\n\nYour application may be affected by this if the following are true:\n\n * You are using @EnableMethodSecurity(mode=ASPECTJ)\u00a0and spring-security-aspects, and\n * You have Spring Security method annotations on a private method\nIn that case, the target method may be able to be invoked without proper authorization.\n\nYou are not affected if:\n\n * You are not using @EnableMethodSecurity(mode=ASPECTJ)\u00a0or spring-security-aspects, or\n * You have no Spring Security-annotated private methods"}, {"lang": "es", "value": "Es posible que Spring Security Aspects no ubique correctamente las anotaciones de seguridad de m\u00e9todos en m\u00e9todos privados. Esto puede provocar una omisi\u00f3n de autorizaci\u00f3n. Su aplicaci\u00f3n podr\u00eda verse afectada si se cumplen las siguientes condiciones: * Utiliza @EnableMethodSecurity(mode=ASPECTJ) y spring-security-aspects, y * Tiene anotaciones de m\u00e9todo de Spring Security en un m\u00e9todo privado. En ese caso, el m\u00e9todo de destino podr\u00eda invocarse sin la autorizaci\u00f3n correspondiente. No se ver\u00e1 afectado si: * No utiliza @EnableMethodSecurity(mode=ASPECTJ) ni spring-security-aspects, o * No tiene m\u00e9todos privados anotados por Spring Security."}], "lastModified": "2025-05-21T20:24:58.133", "sourceIdentifier": "[email protected]"}