CVE-2022-31692
Description
Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies security to forward and include dispatcher types. The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include). The application may forward or include the request to a higher privilege-secured endpoint.The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)
How to fix
- vmware spring_security5.6.9, 5.7.5 or later
- org.springframework.security:spring-security-core5.7.5, 5.6.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vmware spring_security | 5.6.0 ≤ v < 5.6.9, 5.7.0 ≤ v < 5.7.5 | 5.6.9, 5.7.5 |
| netapp active_iq_unified_manager | No range specified | — |
| org.springframework.security:spring-security-coreMaven | 5.7.0 ≤ v < 5.7.5, 5.6.0 ≤ v < 5.6.9 | 5.7.5, 5.6.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.