|
Critical Security Issues Found in the Spring Framework |
|
|
|
Source: searchsoftwarequality - Posted by Bill Keys
|
A recent security assessment of an application by Ounce Labs has resulted in the discovery of two vulnerabilities that can affect Java Web applications that use the Spring Framework.
Spring has been downloaded more than 5 million times to date, which means the security vulnerabilities identified could affect countless companies that use this framework."One of the problems is there's no default checking to make sure the users are only submitting fields that are visible in the form," Berg said. "That means someone can submit additional data in a request and put it into the Java bean."
"The vulnerabilities are not flaws [in the framework]. The issue is developers not understanding the complexity of the framework they're using." Ryan Berg Chief scientist, co-founder, Ounce Labs. So is this a security flaw in the framework or how developers are using it?
Read this full article at searchsoftwarequality
Only registered users can write comments.
Please login or register. Powered by AkoComment! |
