CVE-2022-22976

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-22976
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://tanzu.vmware.com/security/cve-2022-22976 Mitigation Vendor Advisory
https://security.netapp.com/advisory/ntap-20220707-0003/ Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
History

03 Feb 2023, 01:45

Type Values Removed Values Added
First Time Netapp active Iq Unified Manager
Netapp
Oracle
Oracle financial Services Crime And Compliance Management Studio
CPE cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
References (N/A) https://www.oracle.com/security-alerts/cpujul2022.html - (N/A) https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Third Party Advisory
References (CONFIRM) https://security.netapp.com/advisory/ntap-20220707-0003/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20220707-0003/ - Third Party Advisory

25 Jul 2022, 18:20

Type Values Removed Values Added
References
  • (N/A) https://www.oracle.com/security-alerts/cpujul2022.html -

07 Jul 2022, 15:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20220707-0003/ -

01 Jun 2022, 18:20

Type Values Removed Values Added
References (MISC) https://tanzu.vmware.com/security/cve-2022-22976 - (MISC) https://tanzu.vmware.com/security/cve-2022-22976 - Mitigation, Vendor Advisory
First Time Vmware
Vmware spring Security
CVSS v2 : unknown
v3 : unknown 		v2 : 4.3
v3 : 5.3
CPE cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
CWE CWE-190

19 May 2022, 15:35

Type Values Removed Values Added
New CVE
Information

Published : 2022-05-19 15:15

Updated : 2023-02-03 01:45

NVD link : CVE-2022-22976

Mitre link : CVE-2022-22976

JSON object : View

Products Affected

vmware

  • spring_security

oracle

  • financial_services_crime_and_compliance_management_studio

netapp

  • active_iq_unified_manager
CWE
CWE-190

Integer Overflow or Wraparound