Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the browser) to the Authorization Server which can lead to a privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1) on the subsequent request to the token endpoint to obtain the access token.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could     be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify     a request initiated by the Client (via the browser) to the Authorization Server which can lead to a     privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server     responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1)     on the subsequent request to the token endpoint to obtain the access token. (CVE-2022-31690)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could
    be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify
    a request initiated by the Client (via the browser) to the Authorization Server which can lead to a
    privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server
    responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1)
    on the subsequent request to the token endpoint to obtain the access token. (CVE-2022-31690)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1655 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.10.56. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2023:1656

    Security Fix(es):

    * apache-commons-text: variable interpolation RCE (CVE-2022-42889)

    * spring-security-oauth2-client: Privilege Escalation in spring-security-oauth2-client (CVE-2022-31690)

    * spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring     Security (CVE-2022-31692)

    * jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin     (CVE-2023-24422)

    * Jenkins: XSS vulnerability in plugin manager (CVE-2023-27898)

    * Jenkins: Temporary plugin file created with insecure permissions (CVE-2023-27899)

    * kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) (CVE-2022-3172)

    * Jenkins: Temporary file parameter created with insecure permissions (CVE-2023-27903)

    * Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1655 advisory.

  - kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) (CVE-2022-3172)

  - spring-security-oauth2-client: Privilege Escalation in spring-security-oauth2-client (CVE-2022-31690)

  - spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring     Security (CVE-2022-31692)

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
260012	Linux Distros Unpatched Vulnerability : CVE-2022-31690	Nessus	Misc.	Local	high
409219	SCA: security update for org.springframework.security:spring-security-oauth2-client (GHSA-32vj-v39g-jh23)	Tenable Cloud Security	SCA Checks	Local	high
409219	SCA: security update for org.springframework.security:spring-security-oauth2-client (GHSA-32vj-v39g-jh23)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
194304	RHEL 7 / 8 : OpenShift Container Platform 4.10.56 (RHSA-2023:1655)	Nessus	Red Hat Local Security Checks	Local	critical
189435	RHCOS 4 : OpenShift Container Platform 4.10.56 (RHSA-2023:1655)	Nessus	Red Hat Local Security Checks	Local	critical

Detections

Analytics

CVE-2022-31690

high

Tenable Plugins

high

high

high

critical

critical