Cloudanix VulnDB

CVE-2025-22223

Medium · 5.3

CVSS

5.3

EPSS

0.5%

Published

Mar 24, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A problem in security checking for certain kinds of code could let people reach parts of an application they should not be allowed to use.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Library
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Spring Security 6.4.0-6.4.3 fails to locate method security annotations on parameterized types or methods, causing authorization decisions to be skipped and allowing unauthorized method invocation.

Why it matters to the business

Protected application functions may be reachable by unauthenticated or unauthorized callers, increasing risk of data exposure or unintended operations in method-secured Spring applications; low urgency given absence from known exploitation lists and minimal exploit probability trend.

How an attack unfolds

An attacker identifies application endpoints or services that rely on @PreAuthorize or similar annotations placed on methods or types using generics/parameterized declarations, issues requests that would normally be denied, and gains access because the framework does not evaluate the annotations.

How to fix it

Upgrade Spring Security to a version newer than 6.4.3; if upgrade is not immediate, avoid placing security annotations on parameterized types or methods and ensure all annotations are directly on target methods.

How to confirm the fix worked

Confirm Spring Security version is newer than 6.4.3, scan code for security annotations attached to parameterized types or generic methods, and verify that method security enforcement occurs as expected in tests.

Typical attack path

  1. Map application endpoints using method security annotations on parameterized types
  2. Issue HTTP or internal calls targeting the annotated methods
  3. Observe successful execution of protected logic without authentication or role checks

How to detect it

Review application logs for authorization decisions around methods that use generics or parameterized types; look for successful invocations of methods that should have been blocked by annotations.

What your security team should do

  • Prioritize upgrade of Spring Security in all affected applications
  • Audit codebases for method security annotations on parameterized types
  • Temporarily disable @EnableMethodSecurity if annotations cannot be relocated
  • Monitor for any unexpected successful calls to previously protected methods

The record

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass.  You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or methods, or all method security annotations are attached to target methods

Affected packages

Ecosystem Package Introduced Fixed
Maven org.springframework.security:spring-security-core 6.4.0 6.4.4
Chainguard jenkins-2.492 0 2.492.2-r2
maven org.springframework.security/spring-security-core 6.4.0 6.4.4

Related vulnerabilities