cnvd-2026-43187

cnvd

Description

VMware Spring Security是Spring生态里的安全框架‌，用于给Java应用提供认证、授权和攻击防护能力。 VMware Spring Security存在授权绕过漏洞，该漏洞源于在应用程序中使用RegexRequestMatcher以及正则表达式的通配符（.）处理不受信任的输入时存在输入验证错误。目前没有详细的漏洞细节提供。

Timeline

Published: unknown
Last Modified: unknown

CVSS Details

CVSS details not available.

Affected Products

No product information available.

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-22978",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-22978"
    }
  },
  "description": "VMware Spring Security是Spring生态里的安全框架‌，用于给Java应用提供认证、授权和攻击防护能力。\n\nVMware Spring Security存在授权绕过漏洞，该漏洞源于在应用程序中使用RegexRequestMatcher以及正则表达式的通配符（.）处理不受信任的输入时存在输入验证错误。目前没有详细的漏洞细节提供。",
  "discovererName": "Hiroki Nishino, Toshiki Sasazaki, Yoshinori Hayashi, and Jonghwan Kim",
  "formalWay": "目前厂商已发布升级程序修复该安全问题，详情见厂商官网:\r\nhttps://tanzu.vmware.com/security/cve-2022-22978",
  "isEvent": "通用软硬件漏洞",
  "number": "CNVD-2026-43187",
  "openTime": "2026-10-30",
  "patchDescription": "VMware Spring Security是Spring生态里的安全框架‌，用于给Java应用提供认证、授权和攻击防护能力。\r\n\r\nVMware Spring Security存在授权绕过漏洞，该漏洞源于在应用程序中使用RegexRequestMatcher以及正则表达式的通配符（.）处理不受信任的输入时存在输入验证错误。目前没有详细的漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。",
  "patchName": "VMware Spring Security授权绕过漏洞的补丁",
  "products": {
    "product": [
      "VMware Spring Security <5.4.11",
      "VMware Spring Security <5.5.7",
      "VMware Spring Security <5.6.4"
    ]
  },
  "referenceLink": "https://www.cybersecurity-help.cz/vdb/SB2022051717",
  "serverity": "高",
  "submitTime": "2022-05-19",
  "title": "VMware Spring Security授权绕过漏洞"
}

View JSON API Download JSON

cnvd-2026-43187

Raw JSON Data