CVE-2022-22978

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: May 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-229797.5In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functional CVE-2022-22989.8A vulnerability has been found in SourceCodester Clinics Patient Management System 2.0 and classified as critical. Affected by this vulnerab CVE-2022-229809.8A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expres CVE-2022-229827.5The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter CVE-2022-229835.9VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability. A malicious actor with local user pr CVE-2022-229846.3The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk CVE-2022-229858.8The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code CVE-2022-229868.8Netcommunity OG410X and OG810X series (Netcommunity OG410Xa, OG410Xi, OG810Xa, and OG810Xi firmware Ver.2.28 and earlier) allow an attacker CVE-2022-229879.8The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server logi CVE-2022-229889.1File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more diffi CVE-2022-229899.8My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticat CVE-2022-22995.4The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author