CVE-2022-23554

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-23554
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-23554.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-23554
Aliases
Published
2022-12-28T19:15:09Z
Modified
2024-10-12T09:14:12.285452Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows Authentication Filter bypass. The AuthenticationFilter relies on the request URI to evaluate if the user is accessing the swagger endpoint. By accessing a URL with a path such as /api/foo;%2fapi%2fswagger the contains condition will hold and will return from the authentication filter without aborting the request. Note that the principal object will not be assigned and therefore the issue wont allow user impersonation. This issue has been fixed in version 1.10.4. There are no known workarounds.

References

Affected packages

Git / github.com/stevespringett/alpine

Affected ranges

Type
GIT
Repo
https://github.com/stevespringett/alpine
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a9e793d3229f56eefd580d589390bf58bd2910ce

Affected versions

alpine-executable-war-1.*

alpine-executable-war-1.0.0
alpine-executable-war-1.0.1
alpine-executable-war-1.0.2
alpine-executable-war-1.1.0
alpine-executable-war-1.1.1
alpine-executable-war-1.1.2
alpine-executable-war-1.1.3
alpine-executable-war-1.2.0
alpine-executable-war-1.2.1
alpine-executable-war-1.2.10
alpine-executable-war-1.2.11
alpine-executable-war-1.2.2
alpine-executable-war-1.2.3
alpine-executable-war-1.2.4
alpine-executable-war-1.2.5
alpine-executable-war-1.2.6
alpine-executable-war-1.2.7
alpine-executable-war-1.2.8
alpine-executable-war-1.2.9
alpine-executable-war-1.3.0

alpine-parent-1.*

alpine-parent-1.0.0
alpine-parent-1.1.0
alpine-parent-1.1.1
alpine-parent-1.1.2
alpine-parent-1.10.0
alpine-parent-1.10.1
alpine-parent-1.10.2
alpine-parent-1.10.3
alpine-parent-1.2.0
alpine-parent-1.3.0
alpine-parent-1.4.0
alpine-parent-1.4.1
alpine-parent-1.4.2
alpine-parent-1.4.3
alpine-parent-1.5.0
alpine-parent-1.6.0
alpine-parent-1.6.1
alpine-parent-1.6.2
alpine-parent-1.6.3
alpine-parent-1.7.0
alpine-parent-1.7.1
alpine-parent-1.7.2
alpine-parent-1.8.0
alpine-parent-1.9.0
alpine-parent-1.9.1
alpine-parent-1.9.2