Log in Start free

Vulnerability · Published Jun 29, 2021 · Assigned by vmware

CVE-2021-22119

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Spring Security. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.0% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)6.0%top 6.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.springframework.security:spring-security-core5.5.1GHSA-w9jg-gvgr-354m
Mavenorg.springframework.security:spring-security-core5.4.7GHSA-w9jg-gvgr-354m
Mavenorg.springframework.security:spring-security-core5.3.10GHSA-w9jg-gvgr-354m
Mavenorg.springframework.security:spring-security-core5.2.11GHSA-w9jg-gvgr-354m
Mavenorg.springframework.security:spring-security-oauth2-client5.5.1GHSA-w9jg-gvgr-354m
Mavenorg.springframework.security:spring-security-oauth2-client5.4.7GHSA-w9jg-gvgr-354m
Mavenorg.springframework.security:spring-security-oauth2-client5.3.10GHSA-w9jg-gvgr-354m
Mavenorg.springframework.security:spring-security-oauth2-client5.2.11GHSA-w9jg-gvgr-354m

Affected products (as reported)

VendorProductVersions
n/a Spring Security Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11

Weakness: CWE-400

References