CVE-2022-22969
Medium
Description
<Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Pivotal Spring Security Oauth
PublishedApr 21, 2022
First seenApr 21, 2022
How to fix
Update
- pivotal spring_security_oauth2.4.2, 2.5.2 or later
- org.springframework.security.oauth:spring-security-oauth22.5.2.RELEASE, 2.4.2.RELEASE or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pivotal spring_security_oauth | 2.4.0 ≤ v < 2.4.2, 2.5.0 ≤ v < 2.5.2 | 2.4.2, 2.5.2 |
| oracle communications_design_studio | 7.4.2 | — |
| org.springframework.security.oauth:spring-security-oauth2Maven | 2.5.0.RELEASE ≤ v < 2.5.2.RELEASE, 2.4.0.RELEASE ≤ v < 2.4.2.RELEASE | 2.5.2.RELEASE, 2.4.2.RELEASE |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.