Read the docs
TI-2022-13609 Aliases CVE-2022-31690GHSA-32vj-v39g-jh23

Improper privilege management in Spring Security

Priority MEDIUM 40CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-269.

Summary

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the browser) to the Authorization Server which can lead to a privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1) on the subsequent request to the token endpoint to obtain the access token.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0125 69th percentileScored 2026-11-07
Fix Partial org.springframework.security:spring-security-oauth2-client (Maven): 5.7.5, 5.6.9Red Hat: 4 advisoriesRed Hat: 3 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Spring SecuritySpring Security (5.7 to 5.7.4 and 5.6 to 5.6.8 as well as older, unsupported versions)—No fix listedCNA
—org.springframework.security:spring-security-oauth2-client (Maven)5.7.0 to before 5.7.55.7.5Patch availableGHSA-32vj-v39g-jh23
—org.springframework.security:spring-security-oauth2-client (Maven)before 5.6.95.6.9Patch availableGHSA-32vj-v39g-jh23
  • Spring Security Vendor— Affected Spring Security (5.7 to 5.7.4 and 5.6 to 5.6.8 as well as older, unsupported versions) Fixed in — No fix listed CNA
  • org.springframework.security:spring-security-oauth2-client (Maven) Vendor— Affected 5.7.0 to before 5.7.5 Fixed in 5.7.5 Patch available GHSA-32vj-v39g-jh23
  • org.springframework.security:spring-security-oauth2-client (Maven) Vendor— Affected before 5.6.9 Fixed in 5.6.9 Patch available GHSA-32vj-v39g-jh23

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*5.6.0 to before 5.6.9; 5.7.0 to before 5.7.5VulnerableVMware
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* Versions 5.6.0 to before 5.6.9; 5.7.0 to before 5.7.5 Vulnerable ·VMware
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-32vj-v39g-jh23 org.springframework.security:spring-security-oauth2-client (Maven) Fixed in 5.7.5 Advisory →
  • Fix · GHSA-32vj-v39g-jh23 org.springframework.security:spring-security-oauth2-client (Maven) Fixed in 5.6.9 Advisory →

Red Hat 4 advisories

  • RHSA-2023:2041 Released 2023-04-27 · Red Hat rating Important
    Migration Toolkit for Applications security and bug fix update
    • MTA 6.1 for RHEL 8 mta/mta-windup-addon-rhel8
  • RHSA-2023:1655 Released 2023-04-12 · Red Hat rating Critical
    OpenShift Container Platform 4.10.56 security update
    • Red Hat OpenShift Container Platform 4.10 haproxy-2.2.19-4.el8, haproxy22-2.2.19-4.el8, jenkins-2-plugins-4.10.1680703106-1.el8 +5
  • RHSA-2023:1286 Released 2023-03-16 · Red Hat rating Important
    Migration Toolkit for Runtimes security bug fix and enhancement update
    • Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-web-container-rhel8
Show 1 more Red Hat advisories
  • RHSA-2023:1285 Released 2023-03-16 · Red Hat rating Important
    Migration Toolkit for Runtimes security bug fix and enhancement update
    • Migration Toolkit for Runtimes 1 on RHEL 8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for RuntimesAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Integration Camel K 1AffectedNo fix yet: Fix deferred
Red Hat Integration Camel Quarkus 2AffectedNo fix yet: Fix deferred
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
MTA 6.1 for RHEL 8Fixed RHSA-2023:2041
Migration Toolkit for Runtimes 1 on RHEL 8Fixed RHSA-2023:1285, RHSA-2023:1286
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2023:1655
Not affected: 15 products
  • A-MQ Clients 2
  • MTA 6.1 for RHEL 8
  • Migration Toolkit for Runtimes 1 on RHEL 8
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Fuse 7
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Fuse 6
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat Process Automation 7
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel for Spring Boot 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31690
  2. 2026-10-03 Alias added: GHSA-32vj-v39g-jh23
  3. 2026-10-28 Priority changed: LOW → MEDIUM

References

Advisory 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences