CVE-2022-31690
Spring Security
HIGH 8.1
At a glance
- Source
- NVD
- EPSS
- EPSS 1.25 % · percentile 69 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- vmware
- NVD status
- Modified
Description
Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the browser) to the Authorization Server which can lead to a privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1) on the subsequent request to the token endpoint to obtain the access token.
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-32vj-v39g-jh23 — spring-security-oauth2-client vulnerable to Privilege Escalation
European references
- ENISA EUVD · EUVD-2022-7201
- GCVE · GCVE-0-2022-31690
CERT-FR advisories
- CERTFR-2024-AVI-0240 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0012 — Multiples vulnérabilités dans IBM Sterling · cert.ssi.gouv.fr
- CERTFR-2022-AVI-978 — Multiples vulnérabilités dans VMware Spring · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*≥ 5.6.0 < 5.6.9cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*≥ 5.7.0 < 5.7.5cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
Affected products
| Product | Versions |
|---|---|
| Spring Security | affected Spring Security (5.7 to 5.7.4 and 5.6 to 5.6.8 as well as older, unsupported versions) |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |