Vulnerabilities > CVE-2022-22978 - Incorrect Authorization vulnerability in multiple products

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
vmware
oracle
netapp
CWE-863
critical

Summary

In Spring Security versions 5.5.6 and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass

Vulnerable Configurations

Part Description Count
Application
Vmware
198
Application
Oracle
2
Application
Netapp
3

Common Weakness Enumeration (CWE)