{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bd52d957-293e-5120-bf18-b08724a093bf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-cas", "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5", "version": "6.2.8-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-security-cas", "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8", "type": "library", "group": "org.springframework.security", "version": "6.2.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:337d169b-1386-50ec-b035-ba431530614d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4b9b708f-0ae8-577c-9599-1c39d4df91ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:32a3390c-44cc-5e18-a46b-e89d85be6045", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:e380a468-c973-5d9d-80ed-2ddb9dcf4e87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4e858c31-1cad-5aa2-a9a8-1859b8d7e4fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b8b2ed09-9e78-57ce-9197-fe7d6f8aeff8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:5f69fe76-7f13-5a2a-a5da-e3a263b37c5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8a8392cd-f5da-550a-a506-96b214b0d321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:bf5239a7-8623-5598-b487-1a85ea713e8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8aec72e4-d93d-54fb-b6d5-b944d3933f72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:0c4f3e50-eff2-55b2-9ab0-bbe6d869c01a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:fbf5d3ed-401b-583b-a44e-f80d790ebad8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:3d8f4e27-fcdc-5737-a218-0fad77fac390", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1dc5b764-79e5-5b86-8e00-93ff1552282d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ea11c77b-c770-5fea-b7e5-75678b4bc265", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:9e062d80-8490-54eb-bfef-c1f6935bce31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:0df1453d-9b3d-5ffd-9c67-9874b8e6adad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8fd62613-836b-567c-9a06-660353566b36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c11c3526-14a9-57c9-9cb3-65d1aec18b2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ec0483fb-a983-513b-a26b-92007e381324", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:61d5e9b2-37ed-553a-b465-aea2d07b2218", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a40d7364-6d04-56a5-b090-996aed724ee4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:462cfe1a-2af3-5249-8ced-d4bfe0b8f510", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:05a5e547-b06e-583c-ad12-b6f27b3bf7c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:57e91c6f-8a1c-57f1-88f3-0c8ac563e11b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:295d5b4c-e02c-52d5-81f1-ad5a27f877e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38821 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:66cc5ad9-d7e5-5498-a88c-641a02c5cfea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:bc90a499-65ff-5ec6-9d38-3d9834a04fec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:6f6936e6-b9e6-519f-904e-ed5a0f55c3dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1fd773f1-8c78-5e46-aafd-65fcbb6ee548", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:acc2dab9-8581-5210-981f-41a7e07eac86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41232 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ba8a2eb1-154d-5bc7-b4f6-fc1552d94454", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:df278ab2-0d5b-552a-8353-7014712b7dfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1518fa3b-02c1-568f-81dc-5c0a360b27dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b9bbd581-156b-5b19-b861-6c30da758e0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:67da78fa-b4c3-5b59-be2a-4da214a079f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken authentication feature were introduced in Spring Security 6.4.0, which is a later version than the target 6.2.8-tuxcare.6. The feature does not exist in this codebase, therefore the TOCTOU race condition cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:bd29ccef-bd25-555b-bb7e-581512ee6676", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas. not_affected \u2014 Version 6.2.8 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean, a class that does not exist in version 6.2.8. Version 6.2.8 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly handles servlet-path configuration without the builder reassignm...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1112fcc5-4365-5f1a-b90f-a57d168e82e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:50eacd77-eb9d-582a-8068-85e6200ceaf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a95e66cd-f415-5861-842d-3f9604f8a985", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:fe7a5efb-b4da-581f-b54f-0eebcae9060d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:63f0cb4f-c784-5618-b7d4-625444192ce4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:523d9607-4939-5b40-b2f4-c0b7558f531e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-cas. not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. The CVE affects a utility class that classifies IP addresses as internal vs external for access control purposes, but this functionality is not present in 6.2.8. The existing IpAddressMatcher class s...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.5" } ] }