CVE-2019-11272: Insufficiently Protected Credentials and Improper Authentication in Spring Security
Summary
CVE-2019-11272: Insufficiently Protected Credentials and Improper Authentication in Spring Security. Affects org.springframework.security:spring-security-core versions < 4.2.13. Fixed in 4.2.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Security is a powerful and highly customizable security framework for Java applications. It provides authentication and authorization functionalities to secure web applications, RESTful services, and more. The affected package, org.springframework.security:spring-security-core, is a core component of Spring Security that handles authentication and authorization mechanisms. This vulnerability affects versions 4.2.x up to 4.2.12, as well as older unsupported versions.
Vulnerability Detail
The vulnerability in Spring Security arises from the use of PlaintextPasswordEncoder, which supports plain text passwords. If an application utilizing an affected version of Spring Security is using PlaintextPasswordEncoder and a user has a null encoded password, a malicious user can authenticate using a password of 'null'. This can lead to unauthorized access and potential security breaches.
How To Fix
Latest published version: 7.2.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.2.13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a workaround is to switch to a more secure password encoder, such as BCryptPasswordEncoder or Argon2PasswordEncoder, which are not affected by this vulnerability. Here is an example of how to configure BCryptPasswordEncoder in a Spring Security configuration file:
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth
.inMemoryAuthentication()
.passwordEncoder(new BCryptPasswordEncoder())
.withUser("user")
.password("{bcrypt}$2a$10$G7Vf8a4J6k7XW8F5G6H7I8")
.roles("USER");
}
// Other configuration methods...
}
Conclusion
In conclusion, the vulnerability in Spring Security allows for insufficiently protected credentials and improper authentication. It is crucial to upgrade to a fixed version or switch to a more secure password encoder to mitigate the risk of unauthorized access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
Spring Security is a powerful security framework for Java applications that provides authentication and authorization functionalities.
Versions 4.2.x up to 4.2.12 of org.springframework.security:spring-security-core are affected, as well as older unsupported versions.
PlaintextPasswordEncoder is a password encoder in Spring Security that supports plain text passwords.
If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user can authenticate using a password of 'null'.
The CVSS score of this vulnerability is 7.3, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
