cve-2022-31692

CVE-2022-31692 데모 개요 간단한 Spring Boot 애플리케이션으로, CVE-2022-31692에 취약한 구성을 시연합니다. 이 취약점은 심각도 때문에 주목을 받을 만합니다. 인증 우회를 허용하므로 CVSS 3.x 기본 점수는 9.8입니다. 이 프로젝트의 목적은 권고문에 설명된, 취약점이 적용되도록 하는 조건들을 시연하는 것입니다. 애플리케이션은 Spring Security가 forward 및 include 디스패처 유형에 보안을 적용할 것으로 기대합니다. 애플리케이션은 AuthorizationFilter를 수동...

EUVD-2022-7386

Malicious code in bioql PyPI...

spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security

A flaw was found in the spring-security framework. Spring Security could allow a remote attacker to bypass security restrictions caused by an issue when using forward or include dispatcher types. By sending a specially-crafted request, an attacker can bypass authorization rules...

GHSA-MMMH-WCXM-2WR4 Spring Security authorization rules can be bypassed via forward or include dispatcher types

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

CVE-2022-31692: Authorization Bypass Through User-Controlled Key

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...