Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-suxb-vrqh-wffp
Summary
Authorization bypass in Spring Security
In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
Aliases
0
alias CVE-2022-22978
1
alias GHSA-hh32-7344-cg2f
Fixed_packages
0
url pkg:maven/org.springframework.security/spring-security-core@5.4.11
purl pkg:maven/org.springframework.security/spring-security-core@5.4.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-dwcq-d6nf-1ubn
2
vulnerability VCID-u6vb-w2bu-ykfk
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@5.4.11
1
url pkg:maven/org.springframework.security/spring-security-core@5.5.7
purl pkg:maven/org.springframework.security/spring-security-core@5.5.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dwcq-d6nf-1ubn
1
vulnerability VCID-u6vb-w2bu-ykfk
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@5.5.7
2
url pkg:maven/org.springframework.security/spring-security-core@5.6.4
purl pkg:maven/org.springframework.security/spring-security-core@5.6.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8dx4-u4aa-xuet
1
vulnerability VCID-dwcq-d6nf-1ubn
2
vulnerability VCID-u6vb-w2bu-ykfk
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@5.6.4
3
url pkg:maven/org.springframework.security/spring-security-web@5.4.11
purl pkg:maven/org.springframework.security/spring-security-web@5.4.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-vfqt-vr9q-2kfp
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-web@5.4.11
4
url pkg:maven/org.springframework.security/spring-security-web@5.5.7
purl pkg:maven/org.springframework.security/spring-security-web@5.5.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-vfqt-vr9q-2kfp
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-web@5.5.7
5
url pkg:maven/org.springframework.security/spring-security-web@5.6.4
purl pkg:maven/org.springframework.security/spring-security-web@5.6.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-r15d-pzfc-3fg7
1
vulnerability VCID-vfqt-vr9q-2kfp
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-web@5.6.4
Affected_packages
0
url pkg:maven/org.springframework.security/spring-security-core@5.5.0
purl pkg:maven/org.springframework.security/spring-security-core@5.5.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-dwcq-d6nf-1ubn
2
vulnerability VCID-suxb-vrqh-wffp
3
vulnerability VCID-u6vb-w2bu-ykfk
4
vulnerability VCID-ykkv-ahjn-d7eb
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@5.5.0
1
url pkg:maven/org.springframework.security/spring-security-core@5.6.0
purl pkg:maven/org.springframework.security/spring-security-core@5.6.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8dx4-u4aa-xuet
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-dwcq-d6nf-1ubn
3
vulnerability VCID-r15d-pzfc-3fg7
4
vulnerability VCID-suxb-vrqh-wffp
5
vulnerability VCID-u6vb-w2bu-ykfk
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@5.6.0
2
url pkg:maven/org.springframework.security/spring-security-web@5.5.0
purl pkg:maven/org.springframework.security/spring-security-web@5.5.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-suxb-vrqh-wffp
1
vulnerability VCID-vfqt-vr9q-2kfp
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-web@5.5.0
3
url pkg:maven/org.springframework.security/spring-security-web@5.6.0
purl pkg:maven/org.springframework.security/spring-security-web@5.6.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-r15d-pzfc-3fg7
1
vulnerability VCID-suxb-vrqh-wffp
2
vulnerability VCID-vfqt-vr9q-2kfp
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-web@5.6.0
4
url pkg:rpm/redhat/jenkins@2.387.3.1684911776-3?arch=el8
purl pkg:rpm/redhat/jenkins@2.387.3.1684911776-3?arch=el8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2cup-9gdn-yyhk
1
vulnerability VCID-56jv-htmt-rkew
2
vulnerability VCID-6925-fwf4-f7df
3
vulnerability VCID-7xf4-2kjf-87fe
4
vulnerability VCID-dvyn-m8js-xbc2
5
vulnerability VCID-hqzr-vc5w-9ff5
6
vulnerability VCID-mfub-hwcq-pqbt
7
vulnerability VCID-suxb-vrqh-wffp
8
vulnerability VCID-xznu-vdv9-eue6
resource_url http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/jenkins@2.387.3.1684911776-3%3Farch=el8
References
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22978.json
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22978.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-22978
reference_id
reference_type
scores
0
value 0.90406
scoring_system epss
scoring_elements 0.99603
published_at 2026-04-02T12:55:00Z
1
value 0.90406
scoring_system epss
scoring_elements 0.99607
published_at 2026-04-16T12:55:00Z
2
value 0.90406
scoring_system epss
scoring_elements 0.99606
published_at 2026-04-13T12:55:00Z
3
value 0.90406
scoring_system epss
scoring_elements 0.99605
published_at 2026-04-07T12:55:00Z
4
value 0.90406
scoring_system epss
scoring_elements 0.99604
published_at 2026-04-04T12:55:00Z
5
value 0.9071
scoring_system epss
scoring_elements 0.99622
published_at 2026-04-18T12:55:00Z
6
value 0.9071
scoring_system epss
scoring_elements 0.99625
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-22978
2
reference_url https://github.com/anchore/grype/issues/2158
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/anchore/grype/issues/2158
3
reference_url https://github.com/spring-projects/spring-security
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-security
4
reference_url https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-22978
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-22978
6
reference_url https://security.netapp.com/advisory/ntap-20220707-0003
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20220707-0003
7
reference_url https://spring.io/security/cve-2022-22978
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://spring.io/security/cve-2022-22978
8
reference_url https://tanzu.vmware.com/security/cve-2022-22978
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://tanzu.vmware.com/security/cve-2022-22978
9
reference_url https://www.oracle.com/security-alerts/cpujul2022.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpujul2022.html
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2087606
reference_id 2087606
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2087606
11
reference_url https://github.com/advisories/GHSA-hh32-7344-cg2f
reference_id GHSA-hh32-7344-cg2f
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-hh32-7344-cg2f
12
reference_url https://access.redhat.com/errata/RHSA-2022:5532
reference_id RHSA-2022:5532
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:5532
13
reference_url https://access.redhat.com/errata/RHSA-2023:3299
reference_id RHSA-2023:3299
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:3299
Weaknesses
0
cwe_id 285
name Improper Authorization
description The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
1
cwe_id 863
name Incorrect Authorization
description The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
2
cwe_id 625
name Permissive Regular Expression
description The product uses a regular expression that does not sufficiently restrict the set of allowed values.
3
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
4
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score9.0 - 10.0
Exploitability2.0
Weighted_severity9.0
Risk_score10.0
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-suxb-vrqh-wffp