Skip to content
fr Sign in
Not rated

CVE-2022-22978 In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can…

Description

In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

Affected products and versions

Product Affected versions Fixed in
Spring Security Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring Security

The 10 CVEs of Spring Security →
CVE-2024-22257 In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions… 8.2 High CVE-2023-34042 The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were … 4.1 Medium CVE-2023-34034 Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between… 9.1 Critical CVE-2023-34035 Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to… 7.3 High
Track this CVE