GHSA-5x25-c2rf-f2jx
Spring Web Services: SOAP security faults leak Spring Security account state
Quick fix
GHSA-5x25-c2rf-f2jx — org.springframework.ws:spring-ws-security: upgrade to the fixed version with the command below.
# pom.xml: bump <version>5.0.2</version> for org.springframework.ws:spring-ws-securityDetails
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Are you affected?
Enter the version of the package you're using.
Affected packages
5.0.0 Fixed in: 5.0.2 # pom.xml: bump <version>5.0.2</version> for org.springframework.ws:spring-ws-security 4.1.0 Fixed in: 4.1.4 # pom.xml: bump <version>4.1.4</version> for org.springframework.ws:spring-ws-security 4.0.0 No fixed version published yet for org.springframework.ws:spring-ws-security (maven). Pin to a known-safe version or switch to an alternative.
3.1.0 No fixed version published yet for org.springframework.ws:spring-ws-security (maven). Pin to a known-safe version or switch to an alternative.