{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e0deb0df-2101-52e9-8f16-857824369bde", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-test", "purl": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4", "version": "6.0.8-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-security-test", "purl": "pkg:maven/org.springframework.security/spring-security-test@6.0.8", "type": "library", "group": "org.springframework.security", "version": "6.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:8ecf7917-de46-5357-8205-3e9497a6215f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:c9e6159a-b73b-5f54-b576-075c878cafef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:8e6141ce-a14f-52e1-b048-909db8217db8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:d50856b5-9371-51c7-b28d-6f3c89049108", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:30daaca5-13af-5383-b907-3a19e439755a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:93da1b0a-512a-5dea-af23-c8479ab57206", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e1873d1c-d61e-5a8a-931b-e7ad04040a9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:7a29c87f-185c-5518-b4cf-de1f48695cb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:ed4f9ffc-dda5-5699-b216-a78ba4c14aaf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:68ad34e1-60f2-5ccb-9393-6f7d23d56c0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:8cbd74b3-b332-5653-ba85-bc05dbd1ee48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:2d93796a-2514-5b3d-b8a1-f37602b52635", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:5d465fb6-9049-5a64-910c-cab57df1d53a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:443d127c-f411-5df6-8b31-583a4b1ae4a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:8b776e13-c04b-56b3-a05b-e18561d295c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:0d480bbf-29fd-5372-8f7b-437e61835617", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:aa5eb52b-f8e6-56f4-98cd-2f0b5b160232", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:90271b10-c11a-5994-a822-c28196df7529", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:31693842-9c96-5b03-b1ab-2aa3dc36dc25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:9c5ce111-f6e0-590b-a556-a7175fd59e84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:f5617b18-67f0-5e23-b3b6-737aae63bfd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:7a0b7a03-df51-53c0-ae1d-d578c75eb0bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e637c1dd-68c7-5d64-9dec-7071222704bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:6ca74fa8-5d5d-5246-bafa-ed001dfbe4d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:d343c82b-6db4-5ee3-9722-5514cbd3121a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:2b6fe695-eeae-5c35-8229-0e214be0c4ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:cb93a2a3-d079-5a86-8e0b-3193b43ecd55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:f076cb73-1aae-595c-91ff-7a46fafcbb9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:825eabb8-4cf8-5afd-8c43-2b4c3be3aec2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:68bbe0f9-3d5d-55fb-b789-d70ea0c1647c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:64b79c08-8e28-5388-ba28-127dab038d8d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test. Spring Security 6.0.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:1472e397-7482-5f95-b170-6cc757e3e2e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:1397ee21-f43a-5d2c-8eda-7d81efe88a5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:c8635131-b70e-544b-b833-889f805e5b8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:88ecef93-8b31-53ab-b130-0ca907198481", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:ad2f93be-8c86-54f4-af80-27cf72c74812", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire one-time token authentication feature) does not exist in this version. The one-time token login feature was introduced in Spring Security 6.4.0-RC1, released after version 6.0.8. Exhaustive searches across the codebase confirmed no OneTimeToken classes, JdbcOneTimeTo...", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:354c1dc2-7629-5424-b1da-f79f1a0a21c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcher (introduced in Spring Security 7.0) where basePath configuration is not properly applied. Version 6.0.8 uses MvcRequestMatcher for servlet-path support, which correctly implements the servletPath check and does not have the builder reassignment bug. The vulnerable code patterns from bo...", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:0ff55284-a4c0-511a-9cb3-402ca3d996cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:ae09217d-9062-5271-a523-87152c1b8373", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e68e7fd6-e3a3-5330-846f-856505e6de14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:2bcc47cf-4528-5dbe-b150-6f3b50dacdfe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:55fc1f7f-a4fa-5f88-a3a6-b39dcb91fd21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:cca0e16f-1485-5e2f-9446-b795892c24ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-59277. The vulnerability exists in the `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` methods, which do not exist in version 6.0.8. This class was introduced in a later version of Spring Security (after 6.5.11). Without this utility, there is no mechanism to classify IP addresses as internal/external, and th...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.8-tuxcare.4" } ] }