#VU62472 Resource exhaustion in Spring Security OAuth - CVE-2022-22969
Published: April 21, 2022
Vulnerability identifier: #VU62472
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2022-22969
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Spring Security OAuth
Spring Security OAuth
Software vendor:
Pivotal
Pivotal
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing requests initiating the Authorization Request for the Authorization Code Grant. A remote attacker can end multiple requests to the OAuth 2.0 Client, trigger resource exhaustion and perform a denial of service (DoS) attack.
Remediation
Install updates from vendor's website.