CVE-2022-22969

mediumPriorität · verfolgen · 26EPSS 0.013 · 69. PerzentilDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.25% (69th) EPSS

CVSS 4 · medium

Is it mine?

34 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · osv

EPSS · bewertet 2026-10-27

<Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.04mediumAV:N/AC:L/Au:S/C:N/I:N/A:Pprimary · NVD / NIST USAusnutzbarkeit 8 · Auswirkung 2.9

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 3.6

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-400US

betroffene Produkte (34)

Betroffene Produkte und Versionsbereiche.

Oracle Financial Services Applications 14.7.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:14.7.0
Oracle Financial Services Applications 14.7.0.3.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:14.7.0.3.0
Oracle Financial Services Applications 19.1.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:19.1.0
Oracle Financial Services Applications 2.7.1alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:2.7.1
Oracle Financial Services Applications 2.8.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:2.8.0
Oracle Financial Services Applications 2.9.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:2.9.0
Oracle Financial Services Applications 2.9.1alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:2.9.1
Oracle Financial Services Applications 21.1.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:21.1.0
Oracle Financial Services Applications 22.1.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:22.1.0
Oracle Financial Services Applications 22.2.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:22.2.0
Oracle Financial Services Applications 3.0.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:3.0.0
Oracle Financial Services Applications 3.1.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:3.1.0
Oracle Financial Services Applications 4.0.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:4.0.0
Oracle Financial Services Applications 5.0.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:5.0.0
Oracle Financial Services Applications 5.1.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:5.1.0
Oracle Financial Services Applications 6.0.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:6.0.0
Oracle Financial Services Applications 8.0.7alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:8.0.7
Oracle Financial Services Applications 8.0.8alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:8.0.8
Oracle Financial Services Applications 8.0.8.1alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:8.0.8.1
Oracle Financial Services Applications 8.0.8.2alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:8.0.8.2

20 von 34 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2024-0124Oracle Financial Services Applications: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-c2cp-3xj9-97w9Denial of service in Spring Security OAuth22022-04-22ghsa · osvUS
Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cert_bund osv NVD CVE.org MITRE

veröffentlicht 2022-04-21geändert 2026-06-17

Referenzen (11)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan