---
id: CVE-2024-22257
title: |-
  In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 
  5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, 
  versions 6.2.x prior to 6.2.3, an application is possible vulnerable to 
  broken access control whe…
summary: |-
  In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 
  5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, 
  versions 6.2.x prior to 6.2.3, an application is possible vulnerable to 
  broken access control whe…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-862
  - CWE-284
published: '2024-03-18'
updated: '2026-06-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-22257'
references:
  - url: 'https://security.netapp.com/advisory/ntap-20240419-0005/'
    label: security@vmware.com
  - url: 'https://spring.io/security/cve-2024-22257'
    label: security@vmware.com
  - url: 'https://github.com/dependency-check/DependencyCheck/issues/8642'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20240419-0005/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://spring.io/security/cve-2024-22257'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-22257.json
  - url: 'https://access.redhat.com/security/cve/CVE-2024-22257'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2270158'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2024-22257'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-22257'
  - url: 'https://access.redhat.com/errata/RHSA-2024:3354'
  - url: 'https://access.redhat.com/errata/RHSA-2024:3708'
  - url: 'https://access.redhat.com/errata/RHSA-2024:4884'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00956
epssPercentile: 0.61234
ingestedAt: '2026-06-30T13:26:50.066Z'
vendor: Red Hat
product: Red Hat OpenShift Container Platform 3.11
affected:
  - openshift_developer_tools_and_services
  - build_of_apache_camel_hawtio 4
  - build_of_apache_camel_for_spring_boot 3
  - build_of_apache_camel_for_spring_boot 4
  - fuse 7
  - openshift_container_platform 3.11
  - openshift_dev_spaces
  - process_automation 7
  - fuse 7.13.0
  - build_of_apache_camel_3_20_6_for_spring_boot
  - build_of_apache_camel_4_4_1_for_spring_boot 3.2
patched:
  - fuse 7.13.0
  - build_of_apache_camel_3_20_6_for_spring_boot
  - build_of_apache_camel_4_4_1_for_spring_boot 3.2
scores:
  nvd: 8.2
  vendor: 9.8
---

## Overview

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 
5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, 
versions 6.2.x prior to 6.2.3, an application is possible vulnerable to 
broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2024:3354** · Red Hat · fixed in: Red Hat Fuse 7.13.0 · released 2024-05-23 · [advisory](https://access.redhat.com/errata/RHSA-2024:3354)
- **RHSA-2024:3708** · Red Hat · fixed in: Red Hat build of Apache Camel 3.20.6 for Spring Boot · released 2024-06-06 · [advisory](https://access.redhat.com/errata/RHSA-2024:3708)
- **RHSA-2024:4884** · Red Hat · fixed in: Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 · released 2024-07-25 · [advisory](https://access.redhat.com/errata/RHSA-2024:4884)
- **Red Hat VEX** · Important · affected: OpenShift Developer Tools and Services, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel for Spring Boot 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, Red Hat OpenShift Container Platform 3.11, … · no fix planned: OpenShift Developer Tools and Services, Red Hat build of Apache Camel - HawtIO 4, Red Hat Process Automation 7, Red Hat build of Apache Camel for Spring Boot 3, … · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-22257.json)