Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Weakness
The product checks the state of a resource before using that resource, but the resource’s state can change between the check and the use in a way that invalidates the results of the check.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Spring_security | Vmware | 6.4.0 (including) | 6.4.16 (excluding) |
| Spring_security | Vmware | 6.5.0 (including) | 6.5.10 (excluding) |
| Spring_security | Vmware | 7.0.0 (including) | 7.0.5 (excluding) |