{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:66b18b2e-a64d-5968-8535-d0beb5550ef0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6", "version": "6.2.8-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8", "type": "library", "group": "org.springframework.security", "version": "6.2.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:7273c0f2-8c4c-5b76-8714-00fbf150d0e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:7f849f36-6bb5-5e01-872a-86b6deff2d9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:84c0e3f5-9c39-57a8-93fc-e4cb6fd691e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:a9d4c844-1459-5eb6-8f25-7dd4803668e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:2a2b45c2-0620-53da-ab1d-1661f3f19832", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:31696cf0-abbf-5f42-b75b-011ec6c66998", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:b0bb7c07-6827-555e-84dc-f16b7014c9b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:012c932e-bcd2-565a-9837-2815d50c984a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:5049ef80-0657-5b57-95f4-79e136194030", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:9cd01a81-4d26-50d7-8b01-176103db0422", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:b5435a50-3522-58c8-b591-fdba4f7c3753", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:b3f25b38-dd7e-53cb-8d9e-9d9c70ba54f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:d0bdaa9a-d2a5-5f6c-a250-4339f69e4320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:e0166ba1-bb0a-572f-ba17-8a408ff575ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:00dbbf1d-6cbb-5678-b14f-af4bda9d8a85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:baf76cee-1abd-56ba-b90e-1fe6dc7ead8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:51dfc21a-efb5-5967-a4a7-9560eb552ee2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:9e0e49d8-bd17-5721-be45-872f03ff70d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:5a7e22e6-f876-5393-a64e-2c0edf997f08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:9c9fd09f-e238-5eb8-a6bc-640b78ddf26f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:3320851a-40b0-5b88-9272-c7272c35b3c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:25e5d79e-5db2-54e2-af12-722e2e6626ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:19938107-7d42-5a05-a784-2d5605f5185c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:af8c30fa-6654-5b75-95cc-842bcbff5440", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:c057b5ae-b7e5-5c42-b949-7d9c9a5a16f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:abca053d-ecec-59ca-824c-c636ccafae37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:2cbda853-f0a5-5681-8ab4-e8f84a1399f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:69282313-8f26-50d4-b6da-1a84d98b8911", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:21b793ca-485f-563d-bbcb-89ca2b97d71b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl. Spring Security 6.2.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:078937f6-9b89-504a-a76a-be417c5471f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:c821a313-2e17-5393-92d5-329431ea0db5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:a315109f-f007-5805-bb22-dcd7ac45f493", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken authentication feature were introduced in Spring Security 6.4.0, which is a later version than the target 6.2.8-tuxcare.6. The feature does not exist in this codebase, therefore the TOCTOU race condition cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:d0104da3-c048-5087-a2ea-7c5facfcea60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:080c2a3b-e535-5462-9f8d-1d5b80adf7e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:2132e0bc-abc7-55c6-b458-513e01c6d71c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. The CVE affects a utility class that classifies IP addresses as internal vs external for access control purposes, but this functionality is not present in 6.2.8. The existing IpAddressMatcher class s...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.6" } ] }