What is CVE-2022-31692?

CVE-2022-31692 is a critical vulnerability in Spring Security, affecting versions 5.7 before 5.7.5 and 5.6 before 5.6.9. This vulnerability allows attackers to bypass authorization rules via forward or include dispatcher types, potentially leading to unauthorized access and data breaches. Systems using vulnerable versions of Spring Security, including certain NetApp products, are at risk. Organizations should update their software to mitigate this threat and protect their systems.

Who is impacted by this?

Users of Spring Security versions 5.7 before 5.7.5 and 5.6 before 5.6.9 are impacted by CVE-2022-31692. This issue could lead to unauthorized access and data breaches by bypassing authorization rules. It affects various applications and products, including NetApp products like Active IQ Unified Manager for Microsoft Windows and VMware vSphere. If you're using an affected version of Spring Security, your system could be at risk.

What should I do if I'm affected?

If you're affected by the CVE-2022-31692 vulnerability, it's crucial to take action to protect your systems. Follow these simple steps to mitigate the risk:

1. Upgrade to Spring Security 5.7.5 if using version 5.7.x, or to 5.6.9 if using version 5.6.x.

2. If you can't change versions, use authorizeRequests().filterSecurityInterceptorOncePerRequest(false) instead of authorizeHttpRequests().shouldFilterAllDispatcherTypes(true).

3. For versions below 5.7.0, add an ObjectPostProcessor.

4. Update affected NetApp products to fixed software versions and contact NetApp Technical Support if needed.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

CVE-2022-31692 is not listed in CISA's Known Exploited Vulnerabilities Catalog. This critical issue affects Spring Security versions 5.7 before 5.7.5 and 5.6 before 5.6.9, allowing attackers to bypass authorization rules and potentially gain unauthorized access. To mitigate the risk, users should upgrade to the latest version of Spring Security or apply the recommended configuration changes.

Weakness Enumeration

The weakness enumeration for CVE-2022-31692 is categorized as Insufficient Information, indicating a lack of specific details about the vulnerability and its mitigation.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the resources listed below.

• NetApp Product Security

• Osword from SGLAB of Legendsec at Qi'anxin Group

• CVE Record | CVE