Privilege Escalation Vulnerability in Spring Security by VMware

CVE-2022-31690

Summary

Certain versions of Spring Security are vulnerable to privilege escalation that may arise when a malicious user modifies requests to the Authorization Server. If this server responds with an OAuth2 Access Token containing an empty scope list, it can result in unauthorized privileges for the attacker during token requests, leading to potential security breaches.

References