Security scan identified the following files for Spring Framework 5.3.x < 5.3.45 / 6.1.x < 6.1.23 / 6.2.x < 6.2.11 Annotation Detection Vulnerability (CVE-2025-41249).
Path : [FMS_HOME]/state/cartridge.exploded/Automation-Core-7_3_0_1/vcontrol-core-/spring-core-5.3.42.jar
Installed version : 5.3.42
Fixed version : 5.3.45
Path : [FMS_HOME]/state/cartridge.exploded/ActionPack-Runtime-7_3_0_1/Runtime-/spring-core-5.3.42.jar
Installed version : 5.3.42
Fixed version : 5.3.45
CVE-2025-41249
https://nvd.nist.gov/vuln/detail/CVE-2025-41249
Foglight is not vulnerable to CVE-2025-41249 because it does not use @EnableMethodSecurity feature.
STATUS
This issue has been logged as FOG-11214 and is waiting for a fix in a future release of Foglight.
