PT-2022-3458 · Unknown · Spring Security

Hiroki Nishino

+3

·

Published

2022-05-19

·

Updated

2026-04-11

·

CVE-2022-22978

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Spring Security versions prior to 5.4.11 Spring Security versions prior to 5.5.7 Spring Security versions prior to 5.6.4 Spring Security older unsupported versions
Description The issue is related to the RegexRequestMatcher component in Spring Security, which can be misconfigured, allowing for an authorization bypass on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable. The vulnerability can be exploited by a remote attacker to elevate their privileges. The issue can be triggered using symbols such as %0d or %0a.
Recommendations For Spring Security versions prior to 5.4.11, update to version 5.4.11 or later. For Spring Security versions prior to 5.5.7, update to version 5.5.7 or later. For Spring Security versions prior to 5.6.4, update to version 5.6.4 or later. For Spring Security older unsupported versions, consider upgrading to a supported version. As a temporary workaround, consider avoiding the use of . in the regular expression for RegexRequestMatcher until a patch is available. Restrict access to the RegexRequestMatcher component to minimize the risk of exploitation.

Exploit

Fix

Improper Authorization

Incorrect Authorization

Weakness Enumeration

Related Identifiers

BDU:2022-04236
CVE-2022-22978
GHSA-HH32-7344-CG2F
RHSA-2023:3299

Affected Products

Spring Security