Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Spring Security core allows unauthorized access via forwards

CVE-2022-31692 · published 4 years ago
Summary

Versions of Spring Security core before 5.7.5 and 5.6.9 may let a user bypass normal permission checks when the application forwards or includes a request to another part of the system. This can expose higher‑privilege functions to people who should not have them. Update to the latest Spring Security releases or adjust the configuration so that these internal request types are not relied on for security enforcement.

What to do
  • Update springframework org.springframework.security:spring-security-core to version 5.7.5.
  • Update springframework org.springframework.security:spring-security-core to version 5.6.9.
  • Update root io.root.org.springframework.security:spring-security-core to version 5.7.1-root.io.3.
  • Update root io.root.org.springframework.security:spring-security-core to version 5.7.3-root.io.4.
  • Update springframework org.springframework.security:spring-security-core to version 5.7.3-aikido.4.
  • Update root io.root.org.springframework.security:spring-security-core to version 5.7.1-root.io.4.
  • Update springframework org.springframework.security:spring-security-core to version 5.7.1-aikido.4.
  • Update org.springframework.security:spring-security-core to version 5.7.5-aikido.1.
  • Update io.root.org.springframework.security:spring-security-core to version 5.7.5-root.io.1.
  • Update root io.root.org.springframework.security:spring-security-core to version 5.7.1-root.io.1.
  • Update springframework org.springframework.security:spring-security-core to version 5.7.1-aikido.3.
  • Update springframework org.springframework.security:spring-security-core to version 5.7.3-aikido.3.
  • Update springframework org.springframework.security:spring-security-core to version 5.7.3-aikido.5.
  • Update root io.root.org.springframework.security:spring-security-core to version 5.7.3-root.io.3.
  • Update root io.root.org.springframework.security:spring-security-core to version 5.7.3-root.io.5.
Affected software
Ecosystem VendorProductAffected versions
maven springframework org.springframework.security:spring-security-core >= 5.7.0, < 5.7.5
>= 5.6.0, < 5.6.9
Fix: upgrade to 5.7.5
– vmware spring_security >= 5.6.0, < 5.6.9
>= 5.7.0, < 5.7.5
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
– netapp active_iq_unified_manager All versions
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Root:Maven root io.root.org.springframework.security:spring-security-core < 5.7.1-root.io.3
< 5.7.3-root.io.4
< 5.7.1-root.io.4
< 5.7.1-root.io.1
< 5.7.3-root.io.3
< 5.7.3-root.io.5
Fix: upgrade to 5.7.1-root.io.3
Root:Maven springframework org.springframework.security:spring-security-core < 5.7.3-aikido.4
< 5.7.1-aikido.4
< 5.7.1-aikido.3
< 5.7.3-aikido.3
< 5.7.3-aikido.5
Fix: upgrade to 5.7.3-aikido.4
Root:Maven – org.springframework.security:spring-security-core < 5.7.5-aikido.1
Fix: upgrade to 5.7.5-aikido.1
Root:Maven – io.root.org.springframework.security:spring-security-core < 5.7.5-root.io.1
Fix: upgrade to 5.7.5-root.io.1
Ubuntu:Pro:14.04:LTS canonical libspring-java All versions
Original advisory text
CVE-2022-31692 in org.springframework.security:spring-security-core - Patched by Root
Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies security to forward and include dispatcher types. The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include). The application may forward or include the request to a higher privilege-secured endpoint.The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
4% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published31 Oct 2022
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-mmmh-wcxm-2wr4 · GHSA
CVE-2022-31692 · NVD
ROOT-APP-MAVEN-CVE-2022-31692 · OSV
UBUNTU-CVE-2022-31692 · OSV
CVE-2022-31692 · OSV
Track software like this
Free during beta