Spring Security's spring-security.xsd file is world writable
Moderate severity
GitHub Reviewed
Published
Feb 6, 2024
to the GitHub Advisory Database
•
Updated Feb 12, 2024
Package
Affected versions
>= 6.1.1, <= 6.1.3
>= 6.0.4, <= 6.0.6
>= 5.8.4, <= 5.8.6
>= 5.7.9, <= 5.7.10
Patched versions
6.1.4
6.0.7
5.8.7
5.7.11
Description
Published by the National Vulnerability Database
Feb 5, 2024
Published to the GitHub Advisory Database
Feb 6, 2024
Reviewed
Feb 6, 2024
Last updated
Feb 12, 2024
The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system.
While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.
References