{"action":"Upgrade org.springframework.security:spring-security-web to 5.4.11 (5.4.x), 5.5.7 (5.5.x) or 5.6.4 (5.6.x) or later.","affected":[{"fixed":"5.5.7","introduced":"5.5.0"},{"fixed":"5.6.4","introduced":"5.6.0"},{"fixed":"5.4.11","introduced":"0"}],"component":"org.springframework.security:spring-security-web","cve_ids":["CVE-2022-22978"],"ecosystem":"Maven","epss":0.12351,"exploited":false,"fixed_versions":["5.5.7","5.6.4","5.4.11"],"ghsa_id":"GHSA-hh32-7344-cg2f","id":"tcs_01M5N90QAV2DJ55GWJECVYEZ2A","modified_at":"2024-10-04T20:33:08.794410Z","published_at":"2022-05-20T00:00:39Z","references":["https://osv.dev/vulnerability/GHSA-hh32-7344-cg2f","https://nvd.nist.gov/vuln/detail/CVE-2022-22978","https://github.com/anchore/grype/issues/2158","https://github.com/spring-projects/spring-security","https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java","https://security.netapp.com/advisory/ntap-20220707-0003","https://spring.io/security/cve-2022-22978","https://tanzu.vmware.com/security/cve-2022-22978","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-hh32-7344-cg2f#Maven/org.springframework.security:spring-security-web","url":"https://osv.dev/vulnerability/GHSA-hh32-7344-cg2f"}],"summary":"Authorization bypass in Spring Security"}