--- Doc Text *updated* by Eric Christensen <sparks(a)redhat.com> ---
A flaw was found in springframework. CSRF attacks through CORS preflight requests that
target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module)
endpoints are possible. Only non-authenticated endpoints are vulnerable because preflight
requests should not include credentials and therefore requests should fail authentication.
However a notable exception to this are Chrome based browsers when using client
certificates for authentication since Chrome sends TLS client certificates in CORS
preflight requests in violation of spec requirements. No HTTP body can be sent or received
as a result of this attack.
You are receiving this mail because:
You are on the CC list for the bug.