critical9.8
CVE-2022-22978
Authorization bypass in Spring Security
Impact
In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.security:spring-security-core | >= 5.6.0, < 5.6.4 | 5.6.4 |
| maven | org.springframework.security:spring-security-web | >= 5.5.0, < 5.5.7 | 5.5.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Security | before 5.5.7 from 5.6.0 before 5.6.4 |
| Oracle | Financial Services Crime And Compliance Management Studio | Versions 8.0.8.2.0, 8.0.8.3.0 |
| Netapp | Active Iq Unified Manager | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://spring.io/security/cve-2022-22978
- https://github.com/advisories/GHSA-hh32-7344-cg2f
- https://nvd.nist.gov/vuln/detail/CVE-2022-22978
- https://tanzu.vmware.com/security/cve-2022-22978
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.netapp.com/advisory/ntap-20220707-0003
- https://github.com/anchore/grype/issues/2158
- https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java