Skip to content
CVE Tracker
Back

CVE-2016-5007

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for…

High7.5EPSS 2.8%
Published
Updated
Reserved
Assigned by
dell

Description

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

Scores

CVSS scores of CVE-2016-5007, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0High7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS (exploitation in 30 days)
2.8% · top 14% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Affected products

  • Pivotal · Spring Security

    • affected 3.2.x
    • affected 4.0.x
    • affected 4.1.0

  • Pivotal · Spring Framework

    • affected 3.2.x
    • affected 4.0.x
    • affected 4.1.x
    • affected 4.2.x
    • affected older unsupported versions are also affected

Affected packages

From reviewed advisories of the GitHub Advisory Database.

References (4)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .