CVE-2022-22978

CVE-2022-22978

Vendor N/A
Product Spring Security
Weakness CWE-863 · Incorrect authorization
Published May 19, 2022
Last update August 3, 2024

CVSS base score

What the vulnerability does

01Description

In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

Key dates

02Disclosure timeline

May 19, 2022 CVE published
August 3, 2024 Record updated