CVE-2022-22978

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-19 · updated 2026-06-17
Weakness: CWE-863

Description

In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

Affected products

Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
Oracle Financial Services Crime And Compliance Management Studio: 8.0.8.2.0, 8.0.8.3.0
Spring Security: before 5.5.7; from 5.6.0 before 5.6.4 — fixed in 5.5.7, 5.6.4
Spring Security: from Spring security versions 5.4.x prior through 5.4.11+,5.5.x prior to 5.5.7+,5.6.x prior to 5.6.4+ and all earlier unsupported versions

How to fix

Upgrade to a fixed version: Spring Security 5.5.7, 5.6.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-22978 or the next vulnerability affects your stack