CVE-2019-3795 - CVE House
Back to Database
Status published Low CVE-2019-3795

Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security

Vulnerability Description

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-3795

Credits & Attribution

No credits recorded in the NVD database.

References

More from Spring

View All →
CVE-2025-41243
Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux
Critical 10
CVE-2025-41232
CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods
Critical 9.1
CVE-2025-22235
Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed
High 7.3
CVE-2025-22234
Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation
Medium 5.3
CVE-2025-22233
Spring Framework DataBinder Case Sensitive Match Exception
Low 3.1

Affected Vendor

Affected Software

Spring Security
Vulnerable Versions:
5.0, 5.1, 4.2

Timeline

Official Publish: April 9th, 2019
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-330

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.