Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/oauth/spring-security-oauth2/2.5.0.RELEASE/spring-security-oauth2-2.5.0.RELEASE.jar
Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only.
CVE-2022-22969 - Medium Severity Vulnerability
Module for providing OAuth2 support to Spring Security
Library home page: https://docs.spring.io/spring-security/oauth
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/oauth/spring-security-oauth2/2.5.0.RELEASE/spring-security-oauth2-2.5.0.RELEASE.jar
Dependency Hierarchy: - spring-security-oauth2-autoconfigure-2.5.2.jar (Root Library) - :x: **spring-security-oauth2-2.5.0.RELEASE.jar** (Vulnerable Library)
Found in HEAD commit: 0ee792f59c88ec2e75a080212b78199cb833d931
Found in base branch: main
Publish Date: 2022-04-21
URL: CVE-2022-22969
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://tanzu.vmware.com/security/cve-2022-22969
Release Date: 2022-04-21
Fix Resolution (org.springframework.security.oauth:spring-security-oauth2): 2.5.2.RELEASE
Direct dependency fix Resolution (org.springframework.security.oauth.boot:spring-security-oauth2-autoconfigure): 2.5.13
Step up your Open Source Security Game with Mend here