CVE-2022-22976

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published: May 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-229777.1VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administ CVE-2022-229789.8In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigure CVE-2022-229797.5In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functional CVE-2022-22989.8A vulnerability has been found in SourceCodester Clinics Patient Management System 2.0 and classified as critical. Affected by this vulnerab CVE-2022-229809.8A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expres CVE-2022-229827.5The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter CVE-2022-229835.9VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability. A malicious actor with local user pr CVE-2022-229846.3The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk CVE-2022-229858.8The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code CVE-2022-229868.8Netcommunity OG410X and OG810X series (Netcommunity OG410Xa, OG410Xi, OG810Xa, and OG810Xi firmware Ver.2.28 and earlier) allow an attacker CVE-2022-229879.8The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server logi CVE-2022-229889.1File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more diffi