Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2022-31692 EUVD-2022-7386GHSA-mmmh-wcxm-2wr4

Spring Security authorization rules can be bypassed via forward or include dispatcher types

Published Oct 31, 2022 · Updated May 6, 2025 · Assigned by vmware

Package: libspring-java Package: org.springframework.security:spring-security-core Ecosystem: Maven Ecosystem: Ubuntu

Description

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies security to forward and include dispatcher types. The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include). The application may forward or include the request to a higher privilege-secured endpoint.The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)

Affected products

VendorProductAffectedFixed
— Spring by VMware 5.7 to 5.7.4, 5.6 to 5.6.8 and older versions —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 libspring-java No fix yet —
Ubuntu 26.04 LTS libspring-java No fix yet —
Ubuntu 25.10 libspring-java No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 4 haproxy +1 2.2.19-4.el8 RHSA-2023:1655
Red Hat OpenShift 4 jenkins 2.387.1.1680701869-1.el8 RHSA-2023:1655
Red Hat OpenShift 4 jenkins-2-plugins 4.10.1680703106-1.el8 RHSA-2023:1655
Red Hat OpenShift 4 openshift +1 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7 RHSA-2023:1655

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • blipzip/cve-2022-31692 ★ 35 · Nov 3, 2022

    A project demonstrating an app that is vulnerable to Spring Security authorization bypass CVE-2022-31692

  • hotblac/cve-2022-31692 ★ 0 · Oct 29, 2023

    Demonstration of CVE-2022-31692 authorization bypass in Spring Security

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.springframework.security:spring-security-core >= 5.7.0, < 5.7.5 5.7.5 GHSA-mmmh-wcxm-2wr4
Maven org.springframework.security:spring-security-core >= 5.6.0, < 5.6.9 5.6.9 GHSA-mmmh-wcxm-2wr4

Advisories 11

References