Vulnerabilities associated with org.springframework.security:spring-security-web:4.2.12.RELEASE

BDSA-2022-1369 (HIGH): Spring Security is vulnerable to the bypassing of an authorization mechanism due to improperly implemented regular expression matching. A remote attacker could perform unauthorized actions on a vulnerable server by sending maliciously crafted requests to that server.

BDSA-2022-3109 (HIGH): Spring Security contains a flaw when dealing with OAuth2 access token empty scope list responses. A remote attacker could leverage this to escalate their privileges under all the following conditions being met:

• They act as the role of a Login Client (e.g. uses http.oauth2Login()).
• They use one or more authorization rules with authorities mapped from authorized scopes (e.g. anyRequest().hasAuthority("SCOPE_message.write")) in the client application.
• An authorization server that responds with empty scopes list is registered (RFC 6749, Section 5.1).

Note: The role of Resource Servers (http.oauth2ResourceServer()) and applications that do not map authorization rules from authorized scopes (eg. anyRequest().hasAuthority("ROLE_USER")) cannot be exploited by this vulnerability.

Click Here To See More Details On Server