Authorization bypass in Spring by VMware
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 8 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-639.
Summary
Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies security to forward and include dispatcher types. The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include). The application may forward or include the request to a higher privilege-secured endpoint.The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Spring by VMware | 5.7 to 5.7.4, 5.6 to 5.6.8 and older versions | — | No fix listed | CNA |
| — | org.springframework.security:spring-security-core (Maven) | 5.7.0 to before 5.7.5 | 5.7.5 | Patch available | GHSA-mmmh-wcxm-2wr4 |
| — | org.springframework.security:spring-security-core (Maven) | 5.6.0 to before 5.6.9 | 5.6.9 | Patch available | GHSA-mmmh-wcxm-2wr4 |
- Spring by VMware Vendor— Affected 5.7 to 5.7.4, 5.6 to 5.6.8 and older versions Fixed in — No fix listed CNA
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 5.7.0 to before 5.7.5 Fixed in 5.7.5 Patch available GHSA-mmmh-wcxm-2wr4
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 5.6.0 to before 5.6.9 Fixed in 5.6.9 Patch available GHSA-mmmh-wcxm-2wr4
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* | 5.6.0 to before 5.6.9; 5.7.0 to before 5.7.5 | Vulnerable | VMware |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* Versions 5.6.0 to before 5.6.9; 5.7.0 to before 5.7.5 Vulnerable ·VMware
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-mmmh-wcxm-2wr4 org.springframework.security:spring-security-core (Maven) Fixed in 5.7.5 Advisory →
- Fix · GHSA-mmmh-wcxm-2wr4 org.springframework.security:spring-security-core (Maven) Fixed in 5.6.9 Advisory →
Red Hat 2 advisories
- RHSA-2023:3954 Released 2023-06-29 · Red Hat rating CriticalRed Hat Fuse 7.12 release and security update
- Red Hat Fuse 7.12
- RHSA-2023:1655 Released 2023-04-12 · Red Hat rating CriticalOpenShift Container Platform 4.10.56 security update
- Red Hat OpenShift Container Platform 4.10 haproxy-2.2.19-4.el8, haproxy22-2.2.19-4.el8, jenkins-2-plugins-4.10.1680703106-1.el8 +5
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix yet |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat build of Quarkus | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7.12 | Fixed | RHSA-2023:3954 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2023:1655 |
Not affected: 11 products
- A-MQ Clients 2
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Integration Camel K 1
- Red Hat Integration Camel Quarkus 2
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Container Platform 4.10
- Red Hat Single Sign-On 7
- Red Hat build of Apache Camel for Spring Boot 3
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31692
- 2026-10-03 Alias added: GHSA-mmmh-wcxm-2wr4
- 2026-10-28 EPSS moved to the 90th–95th percentile
References
Sources
- CVE-2022-31692 · CVE Program
- CVE-2022-31692 · NVD
- FIRST EPSS
- GHSA-mmmh-wcxm-2wr4 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-31692 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences