CVE-2022-22978

CVE-2022-22978 Spring-Security bypass Demo В Spring Security при использовании RegexRequestMatcher, когда в регулярном выражении содержится точка, злоумышленник может обойти аутентификацию, создав вредоносный пакет. Затрагиваемые версии Spring Security 5.5.x Spring Security 5.6.x...

Incorrect Authorization

Clerk is vulnerable to Incorrect Authorization. The vulnerability is due to improper request matching in createRouteMatcher, which allows an attacker to craft requests that bypass middleware protection and access downstream handlers...

Improper Access Control

Spring Security is vulnerable to Improper Access Control. The vulnerability is due to incorrect request matching when using securityMatchersString with a PathPatternRequestMatcher.Builder that prepends a servlet path, causing requests to bypass the intended filter chain and leaving authentication...