CVE-2019-11272 — PlaintextPasswordEncoder authenticates encoded passwords that are null
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected ver…
Published: 2019-06-26 · CVSS: Unscored
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7