CVE-2022-22978 - Authorization Bypass

Severity: Low2022-09-28

Security Advisories

Abstract

In Spring Security versions 5.5.6 and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

Affected Products/Versions

ProductSeverityFixed Release Availability
Oxygen Content Fusion v5.0 and older versionsLow Oxygen Content Fusion 5.0 build 2022092005
Oxygen Feedback 2.1 and olderLow Oxygen Feedback 2.1 build 2022071516

Mitigation

N/A

Detail

CVE-2022-22978

Severity: Critical

CVSS Score: 9.8

The Spring Security third-party library used by Oxygen XML products is an affected version mentioned in CVE-2022-22978 vulnerability description. However, Oxygen XML products do not invoke the RegexRequestMatcher method. For that reason, we have rated the severity level for our products as low.

List of Security Advisories