PT-2022-15749 · Spring · Spring Security Oauth

Published 2022-04-21 · Updated 2024-10-10 · CVE-2022-22969

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Spring Security OAuth versions 2.5.x prior to 2.5.2 Spring Security OAuth older unsupported versions

Description The issue is a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This exposes OAuth 2.0 Client applications only.

Recommendations For Spring Security OAuth versions 2.5.x prior to 2.5.2, update to version 2.5.2 or later to resolve the issue. For Spring Security OAuth older unsupported versions, consider upgrading to a supported version to mitigate the risk of exploitation. As a temporary workaround, consider restricting the number of Authorization Requests that can be initiated from a single session to minimize the risk of exhausting system resources.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2022-22969

GHSA-C2CP-3XJ9-97W9

Affected Products

Spring Security Oauth

References · 8

• https://tanzu.vmware.com/security/cve-2022-22969 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c2cp-3xj9-97w9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22969 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22969 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://t.me/cibsecurity/41259 · Telegram Post
• https://spring.io/security/cve-2022-22969 · Note
• https://t.me/pentestingnews/22183 · Telegram Post