{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-02T10:41:45.407","vulnerabilities":[{"cve":{"id":"CVE-2019-11272","sourceIdentifier":"security@pivotal.io","published":"2019-06-26T14:15:09.980","lastModified":"2026-06-17T02:12:38.923","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of \"null\"."},{"lang":"es","value":"Spring Security, versiones 4.2.x hasta 4.2.12, y versiones anteriores no compatibles admiten contraseñas de texto sin formato mediante PlaintextPasswordEncoder. Si una aplicación que usa una versión afectada de Spring Security está aprovechando PlaintextPasswordEncoder y un usuario tiene una contraseña codificada nula, un usuario malicioso (o atacante) puede identificarse usando  una contraseña de \"null\"."}],"affected":[{"source":"security@pivotal.io","affectedData":[{"vendor":"Spring","product":"Spring Security","versions":[{"version":"4.2","lessThan":"4.2.13.RELEASE","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@pivotal.io","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-522"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*","versionEndExcluding":"4.2.13","matchCriteriaId":"B45AEB53-BA11-4B6C-9FDE-E4B925D90E1D"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}]}]}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00008.html","source":"security@pivotal.io","tags":["Mailing List","Third Party Advisory"]},{"url":"https://pivotal.io/security/cve-2019-11272","source":"security@pivotal.io","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00008.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://pivotal.io/security/cve-2019-11272","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}