CVE-2021-22119
spring-security: Denial-of-Service (DoS) attack via initiation of Authorization Request
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.
Spring Security versiones 5.5.x anteriores a 5.5.1, versiones 5.4.x anteriores a 5.4.7, versiones 5.3.x anteriores a 5.3.10 y versiones 5.2.x anteriores a 5.2.11 son susceptibles a un ataque de Denegación de Servicio (DoS) por medio de la iniciación de la Petición de Autorización en una Aplicación OAuth versión 2.0 Client Web y WebFlux. Un usuario o atacante malicioso puede enviar múltiples peticiones iniciando la Petición de Autorización para la Concesión del Código de Autorización, lo que tiene el potencial de agotar los recursos del sistema usando una sola sesión o múltiples sesiones
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-04 CVE Reserved
- 2021-06-29 CVE Published
- 2024-03-14 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
- CWE-863: Incorrect Authorization
CAPEC
References (11)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.oracle.com/security-alerts/cpujan2022.html | 2023-11-07 |
| URL | Date | SRC |
|---|---|---|
| https://tanzu.vmware.com/security/cve-2021-22119 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2021-22119 | 2022-07-07 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1977064 | 2022-07-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Vmware Search vendor "Vmware" | Spring Security Search vendor "Vmware" for product "Spring Security" | >= 5.2.0 < 5.2.11 Search vendor "Vmware" for product "Spring Security" and version " >= 5.2.0 < 5.2.11" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Security Search vendor "Vmware" for product "Spring Security" | >= 5.3.0 < 5.3.10 Search vendor "Vmware" for product "Spring Security" and version " >= 5.3.0 < 5.3.10" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Security Search vendor "Vmware" for product "Spring Security" | >= 5.4.0 < 5.4.7 Search vendor "Vmware" for product "Spring Security" and version " >= 5.4.0 < 5.4.7" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Security Search vendor "Vmware" for product "Spring Security" | >= 5.5.0 < 5.5.1 Search vendor "Vmware" for product "Spring Security" and version " >= 5.5.0 < 5.5.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Cloud Native Core Policy Search vendor "Oracle" for product "Communications Cloud Native Core Policy" | 1.14.0 Search vendor "Oracle" for product "Communications Cloud Native Core Policy" and version "1.14.0" | - |
Affected
| ||||||