cve-2022-31692

CVE-2022-31692 演示 概述 一个简单的 Spring Boot 应用程序，演示了一种存在 CVE-2022-31692 漏洞的配置。 该漏洞因其严重性而备受关注——它的 CVSS 3.x 基础评分为 9.8，因为它允许身份验证绕过。 本项目的目的是演示安全公告中描述的、导致该漏洞成立的条件。 应用程序期望 Spring Security 对 forward 和 include 调度器类型应用安全机制。 应用程序手动使用 AuthorizationFilter，或通过 authorizeHttpRequests 方法使用。 应用程序将 FilterChainProxy...

EUVD-2022-7386

Malicious code in bioql PyPI...

spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security

A flaw was found in the spring-security framework. Spring Security could allow a remote attacker to bypass security restrictions caused by an issue when using forward or include dispatcher types. By sending a specially-crafted request, an attacker can bypass authorization rules...

GHSA-MMMH-WCXM-2WR4 Spring Security authorization rules can be bypassed via forward or include dispatcher types

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...