CVE-2022-31692

Deeper analysis

Spring Security versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 are vulnerable to authorization bypass when an application expects the framework to enforce rules on forward and include dispatcher types. The issue manifests specifically when the AuthorizationFilter is in use (either directly or through authorizeHttpRequests()), the FilterChainProxy is explicitly configured to handle forward or include requests, and shouldFilterAllDispatcherTypes(true) is set, allowing a request to be forwarded or included to a higher-privilege endpoint that would otherwise be protected.

An unauthenticated remote attacker can exploit the flaw by crafting requests that leverage forward or include dispatcher types to reach secured resources, bypassing intended authorization checks. Successful exploitation can result in full compromise of confidentiality, integrity, and availability, consistent with the CVSS 9.8 rating.

Advisories from VMware Tanzu and NetApp reference the fixed Spring Security releases and note that the vulnerability is addressed by upgrading to the patched versions. The EPSS score rose from a low baseline to a recorded peak of 0.0838, indicating emerging exploitation interest after disclosure.