CVE-2021-22119: Uncontrolled Resource Consumption

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service DoS attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker c...

PT-2021-3475

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.2.x prior to 5.2.11 Spring Security versions 5.3.x prior to 5.3.10 Spring Security versions 5.4.x prior to 5.4.7 Spring Security versions 5.5.x prior to 5.5.1 Description The issue is related to an uncontrolled...

CVE-2021-22119

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service DoS attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker c...

VMware Spring Security security vulnerability

VMware Spring Security is a suite of security frameworks from VMware that provide illustrative security protections for Spring-based applications. A security vulnerability exists in Spring Security that allows an attacker to send multiple requests to initiate authorization requests granted by the...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +71 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (4.1.4.release)

org.springframework.security:spring-security-web MAVEN version 4.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - am.ik.home:uaa-client =1.0.0, =1.0.0, =1.0.0, =3.0.1.3,...

com.ahome-it:ahome-tooling-server-core (>=1.1.19-release, <=1.1.27-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.23-release, <=1.1.27-release) +57 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (4.2.0.release)

org.springframework.security:spring-security-web MAVEN version 4.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.19-release,...

com.addc:addc-web-mvc (2.5), com.addc:addc-web-struts12 (2.5) +168 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (4.2.4.release)

org.springframework.security:spring-security-web MAVEN version 4.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.addc:addc-web-mvc 2.5 - com.addc:addc-web-struts12...

com.payneteasy.superfly:superfly-web (>=1.2-1, <=1.4-3), org.codehaus.enunciate:enunciate-spring3-security-rt (>=1.20, <=1.22) +10 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (3.0.2.release)

org.springframework.security:spring-security-web MAVEN version 3.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.payneteasy.superfly:superfly-web =1.2-1, =1.20,...

cn.springcloud.gray:spring-cloud-gray-server (>=a.1.1.1, <=a.2.0.0), cn.springcloud.gray:spring-cloud-gray-server-cluster-http-synchro-plugin (>=a.2.0.0.rc1, <=a.2.0.0) +156 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (4.2.13.release)

org.springframework.security:spring-security-web MAVEN version 4.2.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - cn.springcloud.gray:spring-cloud-gray-server =a.1.1.1,...

com.auth0:auth0-spring-security-api (>=1.3.1, <=1.4.0), com.capitalone.dashboard:hygieia-common (>=4.0.5, <=4.1.0) +29 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (4.2.15.release)

org.springframework.security:spring-security-web MAVEN version 4.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.auth0:auth0-spring-security-api =1.3.1, =4.0.5,...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.2, <=0.1.6) +2973 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (>=5.0.0.release, <=5.2.8.release)

org.springframework.security:spring-security-web MAVEN version =5.0.0.release, =4.4.0.0, =0.1.2, =0.5.0, =0.0.2, =0.0.3, =0.0.5 - au.net.causal.shoelaces:shoelaces-apphome-integration-tests-common 2.0 - au.net.causal.shoelaces:shoelaces-assorted-integration-tests-common 2.0 -...

Privilege escalation in spring security

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen it must be programmed in...

cash.muro:cashid4spring (>=0.1.0-alpha, <=0.1.0-alpha2), cash.muro:cashidss (0.1.0-alpha) +703 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (>=5.4.0, <=5.4.3)

org.springframework.security:spring-security-web MAVEN version =5.4.0, =0.1.0-alpha, =0.1.0-alpha, =0.0.1, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.585.9 and more Source cves: CVE-2021-22112 Source...

co.paralleluniverse:comsat-spring-security (0.3.0), com.bq.corbel:oauth-server (>=1.31.1, <=1.35.0) +231 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (3.2.5.release)

org.springframework.security:spring-security-web MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - co.paralleluniverse:comsat-spring-security 0.3.0 -...

am.ik.home:uaa-client (>=1.3.0, <=1.8.1), am.ik.home:uaa-integration-test (>=1.3.0, <=1.8.1) +86 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (4.2.1.release)

org.springframework.security:spring-security-web MAVEN version 4.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - am.ik.home:uaa-client =1.3.0, =1.3.0, =1.3.0, =0.2.0,...

com.sitewhere:sitewhere-activemq (>=1.0.2, <=1.4.0), com.sitewhere:sitewhere-azure (>=1.0.2, <=1.4.0) +39 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (3.2.6.release)

org.springframework.security:spring-security-web MAVEN version 3.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.sitewhere:sitewhere-activemq =1.0.2, =1.0.2, =1.2.0...

com.portlandwebworks:pww-commons (>=1.0, <=1.0.2), de.itsvs:cwtrpc-security (0.9.0) +12 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (3.0.6.release)

org.springframework.security:spring-security-web MAVEN version 3.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.portlandwebworks:pww-commons =1.0, =1.0.2 -...

com.auth0:auth0-spring-security-api (>=1.4.1, <=1.5.3), com.dahuatech.harriet.icc:eco-brm-client (>=1.0.1, <=1.0.1.4) +75 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (4.2.20.release)

org.springframework.security:spring-security-web MAVEN version 4.2.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.auth0:auth0-spring-security-api =1.4.1, =1.0.1,...

com.racquettrack:spring-security-oauth2-client (1.4), com.wichell:framework-web-security (1.0.0) +24 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (3.1.1.release)

org.springframework.security:spring-security-web MAVEN version 3.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.racquettrack:spring-security-oauth2-client 1.4 -...

com.auth0:spring-security-auth0 (0.2), com.brienwheeler.web:web-spring-security (>=1.0-release, <=1.11) +34 more potentially affected by CVE-2021-22112 via org.springframework.security:spring-security-web (3.2.4.release)

org.springframework.security:spring-security-web MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.auth0:spring-security-auth0 0.2 -...