CVE-2022-23554

🗓️ 28 Dec 2022 18:12:41Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 70 Views🌐 WEB

Alpine Java library <=v1.10.4 Authentication Filter bypas

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2022-23554	28 Dec 202222:12	–	circl
CNNVD	Alpine 授权问题漏洞	28 Dec 202200:00	–	cnnvd
Cvelist	CVE-2022-23554 Authentication bypass in Alpine	28 Dec 202218:12	–	cvelist
EUVD	EUVD-2024-2678	3 Oct 202520:07	–	euvd
Github Security Blog	Alpine allows Authentication Filter bypass	5 Aug 202421:18	–	github
NVD	CVE-2022-23554	28 Dec 202219:15	–	nvd
OSV	CVE-2022-23554 Authentication bypass in Alpine	28 Dec 202218:12	–	osv
OSV	GHSA-WHR2-9X5F-5C79 Alpine allows Authentication Filter bypass	5 Aug 202421:18	–	osv
Prion	Race condition	28 Dec 202219:15	–	prion
Positive Technologies	PT-2022-16069 · Alpine · Alpine	28 Dec 202200:00	–	ptsecurity

NVD

Vulners

Node

alpine_project alpineRange<1.10.4

[
  {
    "vendor": "stevespringett",
    "product": "alpine",
    "versions": [
      {
        "version": "< 1.10.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/stevespringett/Alpine/blob/f03dbda46229c26145a5f9f7f2660cc2c386be02/alpine/src/main/java/alpine/filters/AuthenticationFilter.java
github	www.github.com/stevespringett/Alpine/releases/tag/alpine-parent-1.10.4
securitylab	www.securitylab.github.com/advisories/GHSL-2021-1010-Alpine/

Parameter	Position	Path	Description	CWE
path	path	/api/foo;%2fapi%2fswagger	Authentication filter can bypass when path triggers contains condition due to crafted URI, allowing request to pass without abort but without setting principal.	CWE-287, CWE-697

21 Nov 2024 06:48Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.4 - 6.5

EPSS0.00332

SSVC