Not rated
CVE-2022-22978 In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can…
Description
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Security | Versions not published |
Other CVEs of Spring Security
The 10 CVEs of Spring Security →
CVE-2024-22257
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions…
8.2
High
CVE-2023-34042
The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were …
4.1
Medium
CVE-2023-34034
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between…
9.1
Critical
CVE-2023-34035
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to…
7.3
High