vmware spring-security CVE-2014-3527 is a vulnerability in VMware Spring Security
Published on May 25, 2017

When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request. This means if there are access control restrictions on which CAS services can authenticate to one another, those restrictions can be bypassed. If users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service, then there is no impact to users.

NVD


Products Associated with CVE-2014-3527

Want to know whenever a new CVE is published for VMware Spring Security? stack.watch will email you.

VMware Spring Security
 

Affected Versions

Pivotal Spring Security Version 3.1 to 3.2.4 is affected by CVE-2014-3527

Exploit Probability

EPSS
0.36%
Percentile
57.67%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.