CVE-2022-23553 URL access filters bypass in Alpine
Attackers can bypass URL access filters in the Alpine Java library, potentially accessing restricted resources without proper authorization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23553?
CVE-2022-23553 is a high-severity authentication bypass vulnerability in stevespringett alpine, published on 28 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows URL access filter bypass. This issue has been fixed in version 1.10.4. There are no known workarounds.
Weakness: CWE-863
Which versions are affected by CVE-2022-23553?
2 open source packages ship an affected version, including us.springett:alpine. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
us.springett:alpine Maven | All versions | 1.10.4 |
us.springett:alpine Maven | All versions | 1.10.4 |
Products include Alpine Project Alpine.
How do I fix CVE-2022-23553?
Upgrade us.springett:alpine to 1.10.4 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-23553 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-23553 exists.
Other vulnerabilities in stevespringett alpine
Sources
Also known as GHSA-2w4p-2hf7-gh8x.