VMware Spring Security up to 6.4.9/6.5.3 EnableMethodSecurity authorization

Summaryinfo

A vulnerability was found in VMware Spring Security up to 6.4.9/6.5.3. It has been classified as problematic. This impacts an unknown function of the component EnableMethodSecurity. Performing a manipulation results in authorization. This vulnerability is cataloged as CVE-2025-41248. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in VMware Spring Security up to 6.4.9/6.5.3. This affects an unknown code block of the component EnableMethodSecurity. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. This is going to have an impact on confidentiality. The summary by CVE is:

The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass. Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces. This CVE is published in conjunction with CVE-2025-41249 https://spring.io/security/cve-2025-41249 .

It is possible to read the advisory at spring.io. This vulnerability is uniquely identified as CVE-2025-41248 since 04/16/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/29/2026).

The vulnerability scanner Nessus provides a plugin with the ID 265596 (Linux Distros Unpatched Vulnerability : CVE-2025-41249), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.4.10 or 6.5.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (265596), EUVD (EUVD-2025-29538) and CERT Bund (WID-SEC-2025-2060). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• IBM InfoSphere Information Server
• Red Hat Enterprise Linux
• IBM Operational Decision Manager
• IBM Sterling Connect:Direct
• VMware Tanzu Spring Security
• VMware Tanzu Spring Framework
• Red Hat Integration
• HCL Commerce
• Dell Secure Connect Gateway
• Atlassian Bitbucket
• Atlassian Confluence

Productinfo

Vendor

• VMware

Name

• Spring Security

Version

• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3
• 6.4.4
• 6.4.5
• 6.4.6
• 6.4.7
• 6.4.8
• 6.4.9
• 6.5.0
• 6.5.1
• 6.5.2
• 6.5.3

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion