CVE-2016-5007

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

• CWE-264

• http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
• http://www.securityfocus.com/bid/91687Third Party Advisory, VDB Entry
• https://pivotal.io/security/cve-2016-5007Vendor Advisory
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
• http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
• http://www.securityfocus.com/bid/91687Third Party Advisory, VDB Entry
• https://pivotal.io/security/cve-2016-5007Vendor Advisory
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Published

May 25, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5001This is an information disclosure vulnerability in Apache Ha…
• CVE-2016-5002XML external entity (XXE) vulnerability in the Apache XML-RP…
• CVE-2016-5003The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in…
• CVE-2016-5004The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 …
• CVE-2016-5005Cross-site scripting (XSS) vulnerability in Apache Archiva 1…
• CVE-2016-5006The Cloud Controller in Cloud Foundry before 239 logs user-p…
• CVE-2016-5008libvirt before 2.0.0 improperly disables password checking w…
• CVE-2016-5009The handle_command function in mon/Monitor.cc in Ceph allows…
• CVE-2016-5010coders/tiff.c in ImageMagick before 6.9.5-3 allows remote at…
• CVE-2016-5011The parse_dos_extended function in partitions/dos.c in the l…4.6
• CVE-2016-5012In Moodle 3.x, glossary search displays entries without chec…
• CVE-2016-5013In Moodle 2.x and 3.x, text injection can occur in email hea…