Authorization bypass in Spring Security

2022-05-2000:00:39

Google

osv.dev

0.009 Low

EPSS

Percentile

82.3%

JSON

In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass.

CPENameOperatorVersion
org.springframework.security:spring-security-coreeq2.0.0
org.springframework.security:spring-security-coreeq3.2.0.RELEASE
org.springframework.security:spring-security-coreeq5.4.5
org.springframework.security:spring-security-coreeq5.4.1
org.springframework.security:spring-security-coreeq5.2.11.RELEASE
org.springframework.security:spring-security-coreeq5.1.7.RELEASE
org.springframework.security:spring-security-coreeq5.0.5.RELEASE
org.springframework.security:spring-security-coreeq4.1.1.RELEASE
org.springframework.security:spring-security-coreeq4.0.4.RELEASE
org.springframework.security:spring-security-coreeq5.2.8.RELEASE

Name	Operator	Version
org.springframework.security:spring-security-core	eq	2.0.0
org.springframework.security:spring-security-core	eq	3.2.0.RELEASE
org.springframework.security:spring-security-core	eq	5.4.5
org.springframework.security:spring-security-core	eq	5.4.1
org.springframework.security:spring-security-core	eq	5.2.11.RELEASE
org.springframework.security:spring-security-core	eq	5.1.7.RELEASE
org.springframework.security:spring-security-core	eq	5.0.5.RELEASE
org.springframework.security:spring-security-core	eq	4.1.1.RELEASE
org.springframework.security:spring-security-core	eq	4.0.4.RELEASE
org.springframework.security:spring-security-core	eq	5.2.8.RELEASE