PT-2022-3458

Name of the Vulnerable Software and Affected Versions Spring Security versions prior to 5.4.11 Spring Security versions prior to 5.5.7 Spring Security versions prior to 5.6.4 Spring Security older unsupported versions Description The issue is related to the RegexRequestMatcher component in Spring...

africa.absa:inception-oauth2-resource-server (>=1.0.0, <=1.2.0), au.org.consumerdatastandards:client-cli (>=1.13.0, <=2.4.1) +1257 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (>=5.5.0, <=5.5.6)

org.springframework.security:spring-security-web MAVEN version =5.5.0, =1.0.0, =1.13.0, =1.13.0, =1.0.0, =0.0.8-alpha, =0.0.1-alpha, =1.0.4.r, =1.0.4.r, =1.0.4.r, =1.0.4.r, =1.7.26, =1.3.30, =1.1.1-alpha, =1.1.1-alpha, =0.0.3-alpha, =0.0.4-alpha-5 and more Source cves: CVE-2022-22978 Source...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.11) +7645 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (>=2.0.0, <=5.4.10)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =4.4.0.0, =0.1.8, =0.1.6, =0.1.2, =0.5.0, =j8.2.4.0, =j8.2.4.0, =1.0.0, =1.0.0, =1.0.0, =0.0.2, =0.0.3, =1.1.0.release, =0.3, =0.3, =0.6 and more Source cves: CVE-2022-22978 Source advisory: MEND:CVE-2022-22978...

CVE-2022-22978

A flaw was found in Spring Security. When using RegexRequestMatcher, an easy misconfiguration can bypass some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +219 more potentially affected by CVE-2011-2732 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.5.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =1.2.0, =1.1, =0.1, =1.2-1, =2011.11.07.release, =2011.11.07.release, =2011.11.07.release, =3.49, =3.55 and more Source cves: CVE-2011-2732 Source advisory:...

Improper Control of Generation of Code in Spring Security

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +104 more potentially affected by CVE-2011-2732 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.6.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2011-2732 Source advisory:...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +104 more potentially affected by CVE-2011-2732 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.6.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2011-2732 Source advisory: GHSA-5XM9-RF63-WJ...

GHSA-5XM9-RF63-WJ7H Improper Control of Generation of Code in Spring Security

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +219 more potentially affected by CVE-2011-2732 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.5.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =1.2.0, =1.1, =0.1, =1.2-1, =2011.11.07.release, =2011.11.07.release, =2011.11.07.release, =3.49, =3.55 and more Source cves: CVE-2011-2732 Source advisory:...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +300 more potentially affected by CVE-2012-5055 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.7.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.5, =1.6 and more Source cves: CVE-2012-5055 Source advisory: OSV:GHSA-3533-RVPC-6X...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=3.0.1), br.net.woodstock.rockframework:rockframework-persistence (>=2.0.0, <=2.0.8) +270 more potentially affected by CVE-2012-5055 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.7.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =2.0.0, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =3.0.0, =1.2.0, =1.1, =0.1, =1.2-1, =1.0, =1.0.2 - com.revolsys.open:com.revolsys.open.gis.web 2011.11.07.release and more Source cves: CVE-2012-5055 Source advisor...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +300 more potentially affected by CVE-2012-5055 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.7.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.5, =1.6 and more Source cves: CVE-2012-5055 Source advisory: GHSA-3533-RVPC-6X56...

GHSA-3533-RVPC-6X56 Exposure of Sensitive Information to an Unauthorized Actor in Spring Security

DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of logi...

com.ctlok:spring-webmvc-rythm (>=1.3.6, <=1.4.2), com.github.dblock.waffle:waffle-spring-security3 (>=1.5, <=1.6) +171 more potentially affected by CVE-2012-5055 via org.springframework.security:spring-security-core (>=3.1.0.release, <=3.1.2.release)

org.springframework.security:spring-security-core MAVEN version =3.1.0.release, =1.3.6, =1.5, =1.0.0, =3.0.4, =3.3, =1.1.3, =1.1.4, =1.1.3, =1.0.2, =1.0.3 - com.racquettrack:spring-security-oauth2-client 1.4 - com.sitewhere:sitewhere-core 0.9.7 and more Source cves: CVE-2012-5055 Source advisory:...

com.ctlok:spring-webmvc-rythm (>=1.3.6, <=1.4.2), com.github.dblock.waffle:waffle-spring-security3 (>=1.5, <=1.6) +171 more potentially affected by CVE-2012-5055 via org.springframework.security:spring-security-core (>=3.1.0.release, <=3.1.2.release)

org.springframework.security:spring-security-core MAVEN version =3.1.0.release, =1.3.6, =1.5, =1.0.0, =3.0.4, =3.3, =1.1.3, =1.1.4, =1.1.3, =1.0.2, =1.0.3 - com.racquettrack:spring-security-oauth2-client 1.4 - com.sitewhere:sitewhere-core 0.9.7 and more Source cves: CVE-2012-5055 Source advisory:...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=3.0.1), br.net.woodstock.rockframework:rockframework-persistence (>=2.0.0, <=2.0.8) +270 more potentially affected by CVE-2012-5055 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.7.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =2.0.0, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =3.0.0, =1.2.0, =1.1, =0.1, =1.2-1, =1.0, =1.0.2 - com.revolsys.open:com.revolsys.open.gis.web 2011.11.07.release and more Source cves: CVE-2012-5055 Source advisor...

GHSA-4644-HG35-55M9 Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security

Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +104 more potentially affected by CVE-2011-2731 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.6.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2011-2731 Source advisory:...

Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security

Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread...