CVE-2022-22978
springframework: Authorization Bypass in RegexRequestMatcher
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
6Exploited in Wild
-Decision
Descriptions
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
En las versiones 5.5.6 y 5.6.3 de Spring Security y en versiones anteriores no soportadas, RegexRequestMatcher puede ser fácilmente configurado de forma incorrecta para ser evitado en algunos contenedores de servlets. Las aplicaciones que utilizan RegexRequestMatcher con `.` en la expresión regular son posiblemente vulnerables a un bypass de autorización
A flaw was found in Spring Security. When using RegexRequestMatcher, an easy misconfiguration can bypass some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-01-10 CVE Reserved
- 2022-05-19 CVE Published
- 2022-06-02 First Exploit
- 2023-12-10 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-863: Incorrect Authorization
- CWE-1220: Insufficient Granularity of Access Control
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| https://spring.io/security/cve-2022-22978 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/DeEpinGh0st/CVE-2022-22978 | 2022-06-02 | |
| https://github.com/ducluongtran9121/CVE-2022-22978-PoC | 2022-06-04 | |
| https://github.com/aeifkz/CVE-2022-22978 | 2022-07-14 | |
| https://github.com/umakant76705/CVE-2022-22978 | 2022-06-04 | |
| https://github.com/Raghvendra1207/CVE-2022-22978 | 2022-06-04 | |
| https://github.com/wan9xx/CVE-2022-22978-demo | 2024-05-20 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2022-22978 | 2023-05-24 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2087606 | 2023-05-24 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Vmware Search vendor "Vmware" | Spring Security Search vendor "Vmware" for product "Spring Security" | < 5.5.7 Search vendor "Vmware" for product "Spring Security" and version " < 5.5.7" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Security Search vendor "Vmware" for product "Spring Security" | >= 5.6.0 < 5.6.4 Search vendor "Vmware" for product "Spring Security" and version " >= 5.6.0 < 5.6.4" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Financial Services Crime And Compliance Management Studio Search vendor "Oracle" for product "Financial Services Crime And Compliance Management Studio" | 8.0.8.2.0 Search vendor "Oracle" for product "Financial Services Crime And Compliance Management Studio" and version "8.0.8.2.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Financial Services Crime And Compliance Management Studio Search vendor "Oracle" for product "Financial Services Crime And Compliance Management Studio" | 8.0.8.3.0 Search vendor "Oracle" for product "Financial Services Crime And Compliance Management Studio" and version "8.0.8.3.0" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | - | linux |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | - | vmware_vsphere |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | - | windows |
Affected
| ||||||