CVE-2022-31690: spring-security-oauth2-client vulnerable to Privilege Escalation
8.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.41722%
CWE
Published
11/1/2022
Updated
1/31/2023
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.springframework.security:spring-security-oauth2-client | maven | >= 5.7.0, < 5.7.5 | 5.7.5 |
| org.springframework.security:spring-security-oauth2-client | maven | < 5.6.9 | 5.6.9 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper scope validation in OAuth2 client flow processing. Key functions identified are:
- DefaultOAuth2UserService.loadUser() - Directly processes user info and authority mapping from token response
- OAuth2AuthorizationCodeAuthenticationProvider.authenticate() - Handles core authentication flow These functions in vulnerable versions lacked proper checks for empty scope responses, allowing attackers to bypass intended authorization constraints. The first function is higher confidence as it directly handles authority mapping from token data, while the second represents the authentication workflow entry point.