CVE-2022-22978
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-22978
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-22978.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-22978
- Aliases
- Related
- Published
- 2022-05-19T15:15:08Z
- Modified
- 2024-10-12T09:12:48.808643Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with
.in the regular expression are possibly vulnerable to an authorization bypass. - References
Affected packages
Git / github.com/spring-projects/spring-security
Affected ranges
- Type
- GIT
- Repo
- https://github.com/spring-projects/spring-security
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
1.*
1.0.0
1.0.2
1.0.3
1.0.4
1.0.5
2.*
2.5.0.M1
3.*
3.0.0.M2
3.0.0.RC2
3.0.1.RELEASE
3.0.2.RELEASE
3.1.0.M1
3.1.0.M2
3.1.0.RC1
3.1.0.RC2
3.1.0.RC3
3.1.0.RELEASE
3.1.1.RELEASE
3.1.2.RELEASE
3.1.3.RELEASE
3.2.0.M2
4.*
4.1.0.RC1
4.1.0.RC2
4.1.0.RELEASE
4.1.1.RELEASE
4.2.0.M1
4.2.0.RC1
4.2.0.RELEASE
4.2.1.RELEASE
4.2.2.RELEASE
5.*
5.0.0.M1
5.0.0.M2
5.0.0.M3
5.0.0.M4
5.0.0.M5
5.0.0.RC1
5.0.0.RELEASE
5.0.1.RELEASE
5.0.2.RELEASE
5.0.3.RELEASE
5.1.0.M1
5.1.0.M2
5.1.0.RC2
5.1.0.RELEASE
5.1.1.RELEASE
5.2.0.M1
5.2.0.M2
5.2.0.M3
5.2.0.M4
5.2.0.RC1
5.2.0.RELEASE
5.3.0.M1
5.3.0.RC1
5.3.0.RELEASE
5.4.0
5.4.0-M1
5.4.0-M2
5.4.0-RC1
5.5.0
5.5.0-M1
5.5.0-M2
5.5.0-M3
5.5.0-RC1
5.5.0-RC2
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6