René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"CVE-2019-11272 @ Maven-org.springframework.security:spring-security-core-3.2.4.RELEASE","articleBody":"**Vulnerable Package** issue exists @ **Maven\\-org\\.springframework\\.security:spring\\-security\\-core\\-3\\.2\\.4\\.RELEASE** in branch **main**\r\n\r\nSpring Security, versions through 4.2.12 support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of \"null\".\r\n\r\n**Namespace:** James-AST\r\n**Repository:** astlab\r\n**Repository Url:** https://github.com/James-AST/astlab\r\n**CxAST\\-Project:** James-AST/astlab\r\n**CxAST platform scan:** [8d73a497\\-bbc7\\-4126\\-b536\\-ea634bc032dd](https://ast.checkmarx.net/projects/f9affdfe-1e7c-4bfc-a40a-f266cde328d3/scans?id=8d73a497-bbc7-4126-b536-ea634bc032dd\u0026branch=main)\r\n**Branch:** main\r\n**Application:** astlab\r\n**Severity:** HIGH\r\n**State:** NOT_IGNORED\r\n**Status:** RECURRENT\r\n**CWE:** CWE-255\r\n\r\n\r\n----\r\n**Addition Info**\r\n**Attack vector:** NETWORK\r\n**Attack complexity:** LOW\r\n**Confidentiality impact:** LOW\r\n**Availability impact:** LOW\r\n**Remediation Upgrade Recommendation:** 4.2.16.RELEASE\r\n\r\n\r\n----\r\n**References**\r\n[Advisory](https://pivotal.io/security/cve-2019-11272)\r\n[Commit](https://github.com/spring-projects/spring-security/commit/b2d4fec3617c497c5a8eb9c7e5270e0c7db293ee#diff-1077c52b04fb584eef7773921b93dd34)\r\n[Issue](https://github.com/spring-projects/spring-security/issues/7023)\r\n","author":{"url":"https://github.com/jbrotsos","@type":"Person","name":"jbrotsos"},"datePublished":"2022-04-26T16:35:55.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/19/astlab/issues/19"}