GHSA-hh32-7344-cg2fCriticalCVSS 9.8
Authorization bypass in Spring Security
🔗 CVE IDs covered (1)
📋 Description
In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass.
🎯 Affected products6
- maven/org.springframework.security:spring-security-core:>= 5.6.0, < 5.6.4
- maven/org.springframework.security:spring-security-core:>= 5.5.0, < 5.5.7
- maven/org.springframework.security:spring-security-core:< 5.4.11
- maven/org.springframework.security:spring-security-web:>= 5.5.0, < 5.5.7
- maven/org.springframework.security:spring-security-web:>= 5.6.0, < 5.6.4
- maven/org.springframework.security:spring-security-web:< 5.4.11
🔗 References (8)
- https://nvd.nist.gov/vuln/detail/CVE-2022-22978
- https://tanzu.vmware.com/security/cve-2022-22978
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://spring.io/security/cve-2022-22978
- https://security.netapp.com/advisory/ntap-20220707-0003
- https://github.com/anchore/grype/issues/2158
- https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java
- https://github.com/advisories/GHSA-hh32-7344-cg2f