cn.kduck:kduck-security-principal (1.1.3), com.atlassian.connect:atlassian-connect-spring-boot-core (>=3.0.0-beta-1, <=3.0.0) +216 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.7.1, <=5.7.4)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.7.1, =3.0.0-beta-1, =3.0.0-beta-1, =4.3.0, =5.1.3, =5.1.3, =5.1.0, =4.2.0, =0.1.33, =0.1.40 - com.graphql-java-generator:graphql-java-client-dependencies 1.18.8 - com.graphql-java-generator:graphql-java-client-runtime...

CVE-2022-31692

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

UBUNTU-CVE-2022-31692

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

UBUNTU-CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

Authorization

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

Authorization

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

CVE-2022-31690: Privilege Escalation in spring-security-oauth2-client

Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for CVE-2022-31690 affecting the mapping of authorized scopes in spring-security-oauth2-client. Users are encouraged to update as soon as possible. Impact Users who have applied the mitigation should take note of the...

CVE-2022-31692: Authorization rules can be bypassed via forward or include in Spring Security

Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for CVE-2022-31692 affecting the AuthorizationFilter. Users are encouraged to update as soon as possible...

CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

cn.kduck:kduck-security-principal (1.1.3), com.atlassian.connect:atlassian-connect-spring-boot-core (>=3.0.0-beta-1, <=3.0.0) +216 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.7.1, <=5.7.4)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.7.1, =3.0.0-beta-1, =3.0.0-beta-1, =4.3.0, =5.1.3, =5.1.3, =5.1.0, =4.2.0, =0.1.33, =0.1.40 - com.graphql-java-generator:graphql-java-client-dependencies 1.18.8 - com.graphql-java-generator:graphql-java-client-runtime...

au.csiro.pathling:fhir-server (>=5.3.1, <=6.0.2), be.jidoka:jdk-keycloak-admin (1.3.0) +1286 more potentially affected by CVE-2022-31692 via org.springframework.security:spring-security-core (>=5.7.0, <=5.7.4)

org.springframework.security:spring-security-core MAVEN version =5.7.0, =5.3.1, =0.0.1-alpha.1, =0.0.1-alpha.1, =0.0.1-alpha.1, =2.7.0.0, =2.7.0.0, =2.7.0.0, =2.7.1.2, =2.7.0.0, =2.7.2.3, =2.7.0.0, =1.4.1, =1.4.3 and more Source cves: CVE-2022-31692 Source advisory: MEND:CVE-2022-31692...

Authorization rules can be bypassed via forward or include dispatcher types in Spring Security

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: An application is not vulnerable if any of the following i...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.ylyue:yue-library-auth-client (>=j11.2.6.0, <=j11.2.6.1) +1700 more potentially affected by CVE-2022-31692 via org.springframework.security:spring-security-core (>=5.6.0, <=5.6.8)

org.springframework.security:spring-security-core MAVEN version =5.6.0, =4.4.0.2, =j11.2.6.0, =j11.2.6.0, =1.3.1.release, =0.2.0, =0.8.3, =2.1.0.m8, =1.0.0, =2.7.0.beta3, =2.7.0.beta4, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.rc1 and more Source cves: CVE-2022-31692 Source advisory:...

CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

CVE-2022-31690: Undefined Security Weakness

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

PT-2022-20890

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.6 through 5.6.8 Spring Security versions 5.7 through 5.7.4 Description The issue allows a malicious user or attacker to modify a request initiated by the Client to the Authorization Server, potentially leading to a...

CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

CVE-2022-31692

CVE-2022-31692 affects Spring Security prior to 5.7.5 (and 5.6 prior to 5.6.9). The issue allows authorization bypass when an application configures the FilterChainProxy to apply security to forward/include dispatcher types and uses AuthorizationFilter via manual wiring or authorizeHttpRequests()...