Authorization Bypass

Spring Security is vulnerable to authorization bypass. The vulnerability exists in getRequestMatcherPrivilegeEvaluatorsEntry function in WebSecurity.java due to misconfiguration of privilege evaluation which allows an attacker to gain access to the system and perform unauthorized actions...

Spring Security OAuth (spring-security-oauth2) vulnerable to denial-of-service (DoS)

Overview Spring Security OAuth spring-security-oauth2 provided by VMware, Inc. contains a denial-of-service vulnerability due to uncontrolled resource consumption CWE-400. Note that Spring Security OAuth spring-security-oauth2 is no longer supported, therefore Spring Security has been developed a...

Integer Overflow

org.springframework.security:spring-security-crypto is vulnerable to integer overflows. The encoder does not perform any salt rounds when the BCrypt class is used with the maximum work factor31, allowing a local authenticated attacker to cause an integer overflow error resulting in the attacker...

com.github.cwilper.fcrepo-cloudsync:fcrepo-cloudsync-service (>=1.0.0-beta-1, <=1.0.0), com.github.lltyk:tapestry-spring-security (>=3.0.2, <=3.0.3) +128 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.0.5.release)

org.springframework.security:spring-security-web MAVEN version 3.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: -...

co.paralleluniverse:comsat-spring-boot-security (0.7.0), co.paralleluniverse:comsat-spring-security (0.7.0) +226 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.0.4.release)

org.springframework.security:spring-security-web MAVEN version 4.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - co.paralleluniverse:comsat-spring-boot-security 0.7.0 -...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +94 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.1.4.release)

org.springframework.security:spring-security-core MAVEN version 4.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - am.ik.home:uaa-client =1.0.0, =1.0.0, =1.0.0, =3.0.1....

com.capitalone.dashboard:core (>=3.7.20, <=3.9.9), org.ff4j:ff4j-security-spring (>=1.8.2, <=1.8.7) +13 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.1.5.release)

org.springframework.security:spring-security-web MAVEN version 4.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.capitalone.dashboard:core =3.7.20, =1.8.2,...

com.github.waffle.demo:waffle-spring-filter (3.0.0), com.github.waffle.demo:waffle-spring-form (3.0.0) +23 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.19.release)

org.springframework.security:spring-security-web MAVEN version 4.2.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.github.waffle.demo:waffle-spring-filter 3.0.0 -...

com.racquettrack:spring-security-oauth2-client (1.4), com.sitewhere:sitewhere-core (0.9.7) +40 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.1.1.release)

org.springframework.security:spring-security-core MAVEN version 3.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.racquettrack:spring-security-oauth2-client 1.4 -...

com.ctlok:spring-webmvc-rythm (>=1.3.6, <=1.4.2), com.github.leleuj.springframework.security:spring-security-oauth-client (>=1.0.0, <=1.1.0) +137 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.1.0.release)

org.springframework.security:spring-security-core MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.ctlok:spring-webmvc-rythm =1.3.6, =1.0.0, =3.0.4,...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +90 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.5.release)

org.springframework.security:spring-security-web MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1,...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +1535 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (>=5.5.0, <=5.5.6)

org.springframework.security:spring-security-core MAVEN version =5.5.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.13.0, =1.13.0, =2.2.0 - be.jidoka:jdk-keycloak-admin 1.2.0 and more Source cves: CVE-2022-22978 Source advisory:...

org.ff4j:ff4j-security-spring (>=1.0.0, <=1.1.0), org.springframework.security:spring-security-acl (3.0.8.release) +7 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.0.8.release)

org.springframework.security:spring-security-core MAVEN version 3.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.ff4j:ff4j-security-spring =1.0.0, =1.1.0 -...

com.allanditzel:spring-security-csrf-token-filter (1.1), com.cosmicpush:push-server (3.1.4) +55 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.2.0.release)

org.springframework.security:spring-security-web MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.allanditzel:spring-security-csrf-token-filter 1.1 -...

com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta), com.logitags:cibet (>=1.1, <=1.9) +24 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.0.3.release)

org.springframework.security:spring-security-core MAVEN version 3.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.force.sdk:force-springsecurity =22.0.2-beta, =1.1...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +229 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.0.3.release)

org.springframework.security:spring-security-web MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: -...

com.ahome-it:ahome-tooling-server-core (>=1.1.0-release, <=1.1.3-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.0-release, <=1.1.3-release) +69 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.1.0.release)

org.springframework.security:spring-security-core MAVEN version 4.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.0-release...

com.sdl.delivery:udp-service-container-core (>=11.0.0-1078, <=11.0.1-1016), org.springframework.security:spring-security-cas (4.2.16.release) +3 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.16.release)

org.springframework.security:spring-security-web MAVEN version 4.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.sdl.delivery:udp-service-container-core...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=1.12.0), com.atlassian.asap:asap-server-spring-security (>=2.21.8, <=2.21.9) +107 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.11.release)

org.springframework.security:spring-security-web MAVEN version 4.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - au.org.consumerdatastandards:client-cli =1.1.1, =2.21....

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.ylyue:yue-library-auth-client (j11.2.6.0) +1524 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (>=5.6.0, <=5.6.3)

org.springframework.security:spring-security-core MAVEN version =5.6.0, =4.4.0.2, =1.3.1.release, =0.2.0, =0.8.3, =2.1.0.m8, =1.0.0, =2.7.0.beta3, =2.7.0.beta4, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.rc1 and more Source cves: CVE-2022-22978 Source advisory: OSV:GHSA-HH32-7344-CG2F...