There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL
    pattern mappings for authorization and for mapping requests to controllers respectively. Differences in
    the strictness of the pattern matching mechanisms, for example with regards to space trimming in path
    segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped
    to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring
    Framework provides richer features with regards to pattern matching as well as by the fact that pattern
    matching in each Spring Security and the Spring Framework can easily be customized creating additional
    differences. (CVE-2016-5007)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Spring Security 3.2.x、 4.0.x、 4.1.0 和 Spring Framework 3.2.x、 4.0.x、 4.1.x、 4.2.x 依赖于 URL 模式映射分别进行授权和将请求映射到控制器。模式匹配机制的严格性中的差异例如路径段中的空间裁剪可导致 Spring Security 无法将某些不受保护的路径实际上映射到本应受到保护的 Spring MVC 控制器。Spring Framework 提供了更丰富的关于模式匹配的功能，以及 Spring Security 和 Spring Framework 中的模式匹配可以轻松自定义，从而造成额外的差异，这使得问题变得更加复杂。 (CVE-2016-5007)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Spring Security 3.2.x、 4.0.x、 4.1.0 和 Spring Framework 3.2.x、 4.0.x、 4.1.x、 4.2.x 分別依賴 URL 模式對應來進行授權和將要求對應至控制器。模式比對機制的嚴格程度不同 (例如關於路徑區段中的空間修剪)可導致 Spring Security 不將某些路徑識別為未受保護而這些路徑實際上已對應至應受到保護的 Spring MVC 控制器。由於 Spring Framework 提供有關模式比對的更豐富功能以及因每個 Spring Security 和 Spring Framework 中的模式比對可輕鬆自訂並產生其他差異而使問題更加嚴重。 (CVE-2016-5007)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Spring Security 、 3.2.x4.0.x、 4.1.0 と Spring Framework の 3.2.x、 4.0.x、 4.1.x、 4.2.x は、それぞれ承認およびコントローラーへのマッピングリクエストに URL パターンマッピングに依存しています。パスセグメントのスペーストリミングなど、パターンマッチングメカニズムの厳格さの違いにより、Spring Securityが、実際には保護されるべきSpring MVCコントローラーにマッピングされている特定のパスを保護されていないと認識しない可能性があります。この問題は、Spring Framework がパターンマッチングに関してより豊富な機能を提供するだけでなく、各 Spring Security および Spring Framework のパターンマッチングが簡単にカスタマイズ可能で、追加の違いを作成できるという事実により、さらに複雑になります。CVE-2016-5007

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016711 advisory.

    Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL     pattern mappings for authorization and for mapping requests to controllers respectively. Differences in     the strictness of the pattern matching mechanisms, for example with regards to space trimming in path     segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped     to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring     Framework provides richer features with regards to pattern matching as well as by the fact that pattern     matching in each Spring Security and the Spring Framework can easily be customized creating additional     differences.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL     pattern mappings for authorization and for mapping requests to controllers respectively. Differences in     the strictness of the pattern matching mechanisms, for example with regards to space trimming in path     segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped     to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring     Framework provides richer features with regards to pattern matching as well as by the fact that pattern     matching in each Spring Security and the Spring Framework can easily be customized creating additional     differences. (CVE-2016-5007)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
422849	SCA: security update for org.springframework.security:spring-security-core, org.springframework:spring-core (GHSA-8crv-49fr-2h6j)	Tenable Cloud Security	SCA Checks	2025/3/29	2026/7/2	high
422849	SCA: security update for org.springframework.security:spring-security-core, org.springframework:spring-core (GHSA-8crv-49fr-2h6j)	Tenable Self-Hosted Container Security	SCA Checks	2025/3/29	2026/7/2	high
253724	Linux Distros 未修补的漏洞：CVE-2016-5007	Nessus	Misc.	2025/8/24	2026/7/12	high
253724	Linux Distros 未修補的弱點：CVE-2016-5007	Nessus	Misc.	2025/8/24	2026/7/12	high
253724	Linux Distros のパッチ未適用の脆弱性: CVE-2016-5007	Nessus	Misc.	2025/8/24	2026/7/12	high
316276	Unity Linux 20.1070e Security Update: springframework (UTSA-2026-016711)	Nessus	Unity Linux Local Security Checks	2026/5/22	2026/5/22	high
253724	Linux Distros Unpatched Vulnerability : CVE-2016-5007	Nessus	Misc.	2025/8/24	2026/7/12	high

检测

插件搜索

high

high

high

high

high

high

high