CVE-2022-22969

MEDIUM
Published Apr 21, 20224y ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Apr 21, 2022 4y ago
Last Modified Jun 17, 2026 2w ago

Description

<Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 3

VendorProductVersionRange
pivotalspring_security_oauth*≥2.4.0  –  <2.4.2
pivotalspring_security_oauth*≥2.5.0  –  <2.5.2
oraclecommunications_design_studio7.4.2any

References 2

  • tanzu.vmware.com https://tanzu.vmware.com/security/cve-2022-22969
    Vendor Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpujul2022.html
    PatchThird Party Advisory

Remediation

  • oracle.com https://www.oracle.com/security-alerts/cpujul2022.html
    PatchThird Party Advisory