Incorrect Permission Assignment for Critical Resource SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-5905484

[github-actions]

Overview

org.springframework.security:spring-security-config is a security configuration package for Spring Framework.

Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the spring-security.xsd file due to being world writable. An attacker with access to the file system could extract this file and modify it.

Remediation

Upgrade org.springframework.security:spring-security-config to version 5.7.11, 5.8.7, 6.0.7, 6.1.4 or higher.

References

• GitHub Commit
• GitHub Issue
• Spring Advisory