CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

Privilege Escalation in spring-security-oauth2-client

Spring Security, versions 5.7 prior to 5.7.5 , and 5.6 prior to 5.6.9 , and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server whi...

CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

CVE-2022-31692

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

au.csiro.pathling:fhir-server (>=5.3.1, <=6.0.2), be.jidoka:jdk-keycloak-admin (1.3.0) +1286 more potentially affected by CVE-2022-31692 via org.springframework.security:spring-security-core (>=5.7.0, <=5.7.4)

org.springframework.security:spring-security-core MAVEN version =5.7.0, =5.3.1, =0.0.1-alpha.1, =0.0.1-alpha.1, =0.0.1-alpha.1, =2.7.0.0, =2.7.0.0, =2.7.0.0, =2.7.1.2, =2.7.0.0, =2.7.2.3, =2.7.0.0, =1.4.1, =1.4.3 and more Source cves: CVE-2022-31692 Source advisory: MEND:CVE-2022-31692...

PT-2022-20892

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.6 prior to 5.6.9 Spring Security versions 5.7 prior to 5.7.5 Description The issue concerns the potential bypass of authorization rules in Spring Security via forward or include dispatcher types. An application is...

CVE-2022-31692

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

CVE-2022-31692: Authorization Bypass Through User-Controlled Key

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

VMware Spring Security security vulnerability

VMware Spring Security is a suite of security frameworks from VMware that provide illustrative security protections for Spring-based applications. A security vulnerability exists in VMware Spring Security versions 5.7.x prior to 5.7.5 and 5.6.x prior to 5.6.9, which stems from the possibility of...

cn.kduck:kduck-security-principal (1.1.3), com.atlassian.connect:atlassian-connect-spring-boot-core (>=3.0.0-beta-1, <=3.0.0) +216 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.7.1, <=5.7.4)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.7.1, =3.0.0-beta-1, =3.0.0-beta-1, =4.3.0, =5.1.3, =5.1.3, =5.1.0, =4.2.0, =0.1.33, =0.1.40 - com.graphql-java-generator:graphql-java-client-dependencies 1.18.8 - com.graphql-java-generator:graphql-java-client-runtime...

Authorization rules can be bypassed via forward or include dispatcher types in Spring Security

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: An application is not vulnerable if any of the following i...

CVE-2022-31692

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

PT-2022-20890

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.6 through 5.6.8 Spring Security versions 5.7 through 5.7.4 Description The issue allows a malicious user or attacker to modify a request initiated by the Client to the Authorization Server, potentially leading to a...

cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory (3.1.0.release), cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory-conf (3.1.0.release) +573 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.0.4.release, <=5.6.8)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.0.4.release, =1.1.1-alpha, =1.1.1-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.1, =0.3 - cn.itlym:shoulder-security-code 0.3 - cn.itlym:shoulder-starter-auth-server 0.3 -...

CVE-2022-31690

CVE-2022-31690 affects Spring Security versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9. A malicious user could modify a client-initiated request to the Authorization Server, leading to privilege escalation on the subsequent approval if the OAuth2 Access Token Response incorrectly contains an e...

CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

VMware Spring Security security vulnerability

VMware Spring Security is a suite of security frameworks from VMware that provide illustrative security protections for Spring-based applications. A security vulnerability exists in VMware Spring Security versions 5.7.x prior to 5.7.5 and 5.6.x prior to 5.6.9, which stems from a malicious user or...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.ylyue:yue-library-auth-client (>=j11.2.6.0, <=j11.2.6.1) +1700 more potentially affected by CVE-2022-31692 via org.springframework.security:spring-security-core (>=5.6.0, <=5.6.8)

org.springframework.security:spring-security-core MAVEN version =5.6.0, =4.4.0.2, =j11.2.6.0, =j11.2.6.0, =1.3.1.release, =0.2.0, =0.8.3, =2.1.0.m8, =1.0.0, =2.7.0.beta3, =2.7.0.beta4, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.rc1 and more Source cves: CVE-2022-31692 Source advisory:...

This Week in Spring - October 25th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! When last we spoke, I was in Las Vegas, NV, for the JavaOne show. It was amazing! Im in sunny Singapore, then off to Malaysia and Thailand. Its the first time Ive been to any of these places since 2019! How good it is to be...