Denial-of-Service Vulnerability in Spring Security by VMware
CVE-2021-22119

7.5HIGH

Key Information:

Vendor: Vmware
Status: Spring Security
Vendor: CVE Published:; 29 June 2021

Badges

👾 Exploit Exists🟡 Public PoC

Summary

Spring Security is vulnerable to a Denial-of-Service attack that can be triggered via the Authorization Request initiation in OAuth 2.0 Client Web and WebFlux applications. This vulnerability allows an attacker to send repeated requests for the Authorization Code Grant, potentially leading to resource exhaustion. Affected versions include Spring Security 5.5.x, 5.4.x, 5.3.x, and 5.2.x. Organizations are advised to update to the latest versions to mitigate this risk.

Affected Version(s)

Spring Security Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

oauth-client-exploit
Created by mari6274