CVE-2021-22119
spring-security: Denial-of-Service (DoS) attack via initiation of Authorization Request
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.
Spring Security versiones 5.5.x anteriores a 5.5.1, versiones 5.4.x anteriores a 5.4.7, versiones 5.3.x anteriores a 5.3.10 y versiones 5.2.x anteriores a 5.2.11 son susceptibles a un ataque de Denegación de Servicio (DoS) por medio de la iniciación de la Petición de Autorización en una Aplicación OAuth versión 2.0 Client Web y WebFlux. Un usuario o atacante malicioso puede enviar múltiples peticiones iniciando la Petición de Autorización para la Concesión del Código de Autorización, lo que tiene el potencial de agotar los recursos del sistema usando una sola sesión o múltiples sesiones
This release of Red Hat Fuse 7.11.0 serves as a replacement for Red Hat Fuse 7.10 and includes bug fixes and enhancements, which are documented in the Release Notes document linked in the References. Issues addressed include HTTP request smuggling, bypass, code execution, denial of service, deserialization, information leakage, memory leak, privilege escalation, and traversal vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-04 CVE Reserved
- 2021-06-29 CVE Published
- 2022-11-09 First Exploit
- 2024-08-03 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-400: Uncontrolled Resource Consumption
- CWE-863: Incorrect Authorization
CAPEC
References (12)
| URL | Date | SRC |
|---|---|---|
| https://github.com/mari6274/oauth-client-exploit | 2022-11-09 |
| URL | Date | SRC |
|---|---|---|
| https://www.oracle.com/security-alerts/cpujan2022.html | 2023-11-07 |
| URL | Date | SRC |
|---|---|---|
| https://tanzu.vmware.com/security/cve-2021-22119 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2021-22119 | 2022-07-07 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1977064 | 2022-07-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Vmware Search vendor "Vmware" | Spring Security Search vendor "Vmware" for product "Spring Security" | >= 5.2.0 < 5.2.11 Search vendor "Vmware" for product "Spring Security" and version " >= 5.2.0 < 5.2.11" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Security Search vendor "Vmware" for product "Spring Security" | >= 5.3.0 < 5.3.10 Search vendor "Vmware" for product "Spring Security" and version " >= 5.3.0 < 5.3.10" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Security Search vendor "Vmware" for product "Spring Security" | >= 5.4.0 < 5.4.7 Search vendor "Vmware" for product "Spring Security" and version " >= 5.4.0 < 5.4.7" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Security Search vendor "Vmware" for product "Spring Security" | >= 5.5.0 < 5.5.1 Search vendor "Vmware" for product "Spring Security" and version " >= 5.5.0 < 5.5.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Cloud Native Core Policy Search vendor "Oracle" for product "Communications Cloud Native Core Policy" | 1.14.0 Search vendor "Oracle" for product "Communications Cloud Native Core Policy" and version "1.14.0" | - |
Affected
| ||||||