CVE-2022-23554

🗓️ 28 Dec 2022 18:12:41Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 106 Views🌐 WEB

Alpine Java library <=v1.10.4 Authentication Filter bypas

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2022-23554	28 Dec 202222:12	–	circl
CNNVD	Alpine Authorization Issue Vulnerability	28 Dec 202200:00	–	cnnvd
Cvelist	CVE-2022-23554 Authentication bypass in Alpine	28 Dec 202218:12	–	cvelist
EUVD	EUVD-2024-2678	3 Oct 202520:07	–	euvd
Github Security Blog	Alpine allows Authentication Filter bypass	5 Aug 202421:18	–	github
Mend	CVE-2022-23554	28 Dec 202218:12	–	mend
NVD	CVE-2022-23554	28 Dec 202219:15	–	nvd
osv_ghsa	GHSA-WHR2-9X5F-5C79 Alpine allows Authentication Filter bypass	5 Aug 202421:18	–	osv_ghsa
Prion	Race condition	28 Dec 202219:15	–	prion
Positive Technologies	PT-2022-16069 · Alpine · Alpine	28 Dec 202200:00	–	ptsecurity

NVD

Vulners

Node

alpine_project alpineRange<1.10.4

[
  {
    "vendor": "stevespringett",
    "product": "alpine",
    "versions": [
      {
        "version": "< 1.10.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
securitylab	www.securitylab.github.com/advisories/GHSL-2021-1010-Alpine/
github	www.github.com/stevespringett/Alpine/blob/f03dbda46229c26145a5f9f7f2660cc2c386be02/alpine/src/main/java/alpine/filters/AuthenticationFilter.java
github	www.github.com/stevespringett/Alpine/releases/tag/alpine-parent-1.10.4

Parameter	Position	Path	Description	CWE
path	path	/api/foo;%2fapi%2fswagger	Authentication Filter bypass via path traversal/normalization issue where a semicolon and encoded slash allow bypassing the swagger endpoint check.	CWE-287, CWE-697

17 Jun 2026 04:30Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.4 - 6.5

EPSS0.00716

SSVC