Resource exhaustion in Spring Security OAuth - CVE-2022-22969
Published: April 21, 2022
Vulnerability identifier: #VU62472
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-22969
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing requests initiating the Authorization Request for the Authorization Code Grant. A remote attacker can end multiple requests to the OAuth 2.0 Client, trigger resource exhaustion and perform a denial of service (DoS) attack.
Affected software
Spring Security OAuth
Oracle Communications Design Studio
IBM Sterling Partner Engagement Manager
Oracle Banking Liquidity Management
Cloud Foundry UAA
IBM Sterling Partner Engagement Manager on Cloud / SaaS
Oracle Communications Design Studio
IBM Sterling Partner Engagement Manager
Oracle Banking Liquidity Management
Cloud Foundry UAA
IBM Sterling Partner Engagement Manager on Cloud / SaaS
How to mitigate CVE-2022-22969
Install updates from vendor's website.
Spring Security OAuth - update to 2.5.2
Cloud Foundry UAA - update to 75.19.0
IBM Sterling Partner Engagement Manager - addressed in versions 6.1.2.6, 6.2.0.4, 6.2.1.1
IBM Sterling Partner Engagement Manager on Cloud / SaaS - update to 22.3.1
Cloud Foundry UAA - update to 75.19.0
IBM Sterling Partner Engagement Manager - addressed in versions 6.1.2.6, 6.2.0.4, 6.2.1.1
IBM Sterling Partner Engagement Manager on Cloud / SaaS - update to 22.3.1