NetSight
IP …
high7.5

CVE-2021-22119

Resource Exhaustion in Spring Security

Impact

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.springframework.security:spring-security-core>= 5.5.0, < 5.5.15.5.1
mavenorg.springframework.security:spring-security-oauth2-client>= 5.5.0, < 5.5.15.5.1

Affected products

VendorProductAffected versions
VmwareSpring Security
from 5.2.0 before 5.2.11
from 5.3.0 before 5.3.10
from 5.4.0 before 5.4.7
from 5.5.0 before 5.5.1
OracleCommunications Cloud Native Core Policy
Version 1.14.0

Weakness classification

CWE-400CWE-863

References