Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
spring-projects/spring-webflow
main @ c5b1699
7
Fixes
0
CVEs
HIGH
Peak severity
57.1%
Coverage
Highlights
Auth Bypass: 4 prior fixes. Scrutinize any change in this area.
spring-webflow: most-fixed (1 issue). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: State leakage within the listener globally cached the decision manager type (ANY or ALL) of the first evaluated security rule, corrupting all subsequent security evaluations across different users or contexts.
Auth Bypass: A logical reversal in the collection comparison logic within 'isAuthorizedAll' erroneously permitted access to users who did not hold all required authorization authorities.
Insecure Deserialization: Deserializing untrusted flow execution snapshots without overriding dynamic proxy class resolution or ensuring proper classloader constraints could allow code execution.