CVE-2022-22950 Spring framework vulnerability in Advanced Authentication Admin and UDS

Products

• CA Risk Authentication
• CA Strong Authentication
• CA Advanced Authentication

Issue/Introduction

CVE-2022-22950 Spring framework vulnerability in AA Admin and UDS  in a medium priority vulnerability related to AA Admin UI and AA UDS.

Refer to this link for this CVE-2022-22950 --- https://nvd.nist.gov/vuln/detail/CVE-2022-22950

Cause

In Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL (Spring Expression Language) expression that may cause a denial of service condition.

Environment

Release : 9.1

Component : AuthMinder(Arcot WebFort) Strong Authentication

RiskMinder (Arcot RiskFort) Risk Authentication

Resolution

This is low medium vulnerability and AA Product Management's current ETA for remediating this vulnerability is August 19th 2022 tentatively. The older unsupported versions of Spring Framework will not be used in AA Admin and UDS components (in AA Service Pack 4  - aka SP4).

Additional Information

None.