Improper Authorization in Spring Security - CVE-2022-22978

Vulnerability identifier: #VU63345

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22978

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to bypass authorization process.

The vulnerability exists due to input validation error when processing untrusted input in applications that are using RegexRequestMatcher with `.` in the regular expression. A remote non-authenticated attacker can bypass authorization checks.

Spring Security
IBM i Modernization Engine for Lifecycle Integration
RecoverPoint Classic
Dell Policy Manager for Secure Connect Gateway (SCG)
Storage Copy Data Management
Storage Protect Plus Server
Communications Unified Assurance
Oracle Communications Interactive Session Recorder
Oracle Utilities Testing Accelerator
Oracle Financial Services Crime and Compliance Management Studio
Oracle Communications Element Manager
Oracle Banking Corporate Lending Process Management
Oracle SD-WAN Edge
IBM Process Mining
IBM Sterling B2B Integrator
IBM Common Licensing
NetWorker
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Bosh Release for the UAA
Cloud Foundry UAA
jenkins (Red Hat package)
jenkins-2-plugins (Red Hat package)
Dell EMC VxRail Appliance
IBM InfoSphere Information Server

Install updates from vendor's website.

Spring Security - addressed in versions 5.5.7, 5.6.4
IBM i Modernization Engine for Lifecycle Integration - update to 1.0.1
RecoverPoint Classic - update to 5.1 SP4 P4
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.12.00.00
Bosh Release for the UAA - update to 75.20.0
Cloud Foundry UAA - update to 75.20.0
IBM Process Mining - update to 1.14.1
Storage Copy Data Management - update to 2.2.23.0
jenkins (Red Hat package) - update to 2.387.3.1684911776-3.el8
jenkins-2-plugins (Red Hat package) - update to 4.13.1684911916-1.el8
IBM Sterling B2B Integrator - addressed in versions 6.0.3.8, 6.1.2.2
Dell EMC VxRail Appliance - update to 7.0.372
IBM Common Licensing - update to 9.0.0.6
Storage Protect Plus Server - update to 10.1.16.1
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
NetWorker - update to 19.9.0.0

• Exploit #8924 - CVE-2022-22978 () (March 18, 2023)
• Exploit #8140 - CVE-2022-22978 (CVE-2022-22978 POC Project) (July 14, 2022)

• https://tanzu.vmware.com/security/cve-2022-22978

• Multiple vulnerabilities in VMware Spring Security
• Multiple vulnerabilities in Cloud Foundry uaa-release
• Multiple vulnerabiities in Cloud Foundry UAA
• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Multiple vulnerabilities in Oracle Financial Services Crime and Compliance Management Studio
• Multiple vulnerabilities in Dell Policy Manager for Secure Connect Gateway
• Multiple vulnerabilities in Dell VxRail
• Multiple vulnerabilities in Oracle SD-WAN Edge
• Multiple vulnerabilities in Oracle Communications Interactive Session Recorder
• Multiple vulnerabilities in Oracle Communications Element Manager
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Utilities Testing Accelerator
• Multiple vulnerabilities in Communications Unified Assurance
• Improper authorization in IBM Common Licensing
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in Oracle Banking Corporate Lending Process Management
• Multiple vulnerabilities in Dell RecoverPoint Classic
• Multiple vulnerabilities in IBM InfoSphere Information Server
• OpenShift Developer Tools and Services for OCP 4.13 update for jenkins and jenkins-2-plugins
• IBM Process Mining update for Spring Security
• Multiple vulnerabilities in Dell Networker
• Multiple vulnerabilities in IBM Storage Protect Plus Server
• Multiple vulnerabilities in IBM Storage Copy Data Management