CVE-2022-22978

Critical

Advisory

Published 20 May 2022In the index since 6 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.124; 96th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 57; of 17,781 indexed, latest versions
Container images: 76; deployed by those charts
Fix available: 2 of 2; affected packages

Authorization bypass in Spring Security

Carried by container images the latest versions of 57 of 17,781 indexed charts deploy, on 76 images.

Affected package	Affected versions	Fixed in	Images
spring-security-coremaven	3.0.4, 3.2.10.RELEASE, 4.1.3.RELEASE, 4.2.2.RELEASE+25 more	5.4.11, 5.5.7, 5.6.4	76
spring-security-webmaven	3.2.10.RELEASE, 4.1.3.RELEASE, 4.1.4.RELEASE, 4.2.2.RELEASE+24 more	5.4.11, 5.5.7, 5.6.4	71

OSV records: GHSA-hh32-7344-cg2f

Charts affected

57 by stars

Chart

Latest

Affected images

Radar Score

atlassian-jirasomeblackmagic

3.3.2

1 of 1 See more

atlassian-jira someblackmagic 3.3.2

1 of the 1 container images this version deploys carry CVE-2022-22978.

Container image	Digest	Package	Fixed in
atlassian/jira-software :8.14.0	37bc46cbec1a	spring-security-core@5.2.1.RELEASE	5.4.11

Open the chart page →

13,079

umsappstacksimplify

1.0.0

1 of 3 See more

umsapp stacksimplify 1.0.0

1 of the 3 container images this version deploys carry CVE-2022-22978.

Container image	Digest	Package	Fixed in
ghcr.io/stacksimplify/kube-usermgmt-webapp :1.0.0-mysqldb	41b45003c6b6	spring-security-core@5.1.5.RELEASE spring-security-web@5.1.5.RELEASE	5.4.11 5.4.11

Open the chart page →

6,101

streamastreama

1.0.1

1 of 2 See more

streama streama 1.0.1

1 of the 2 container images this version deploys carry CVE-2022-22978.

Container image	Digest	Package	Fixed in
just1not2/streama :1.10.4	8a2305192dec	spring-security-core@3.0.4 spring-security-web@4.1.4.RELEASE	5.4.11 5.4.11

Open the chart page →

8,554

rundecksvtech-public-helm-charts

1.0.0

1 of 2 See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2022-22978.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	spring-security-core@5.2.1-plain	5.4.11

Open the chart page →

18,756

shenyutest-helm

2.4.21

1 of 2 See more

shenyu test-helm 2.4.21

1 of the 2 container images this version deploys carry CVE-2022-22978.

Container image	Digest	Package	Fixed in
apache/shenyu-bootstrap :2.4.2	0bd3b25c4be4	spring-security-core@5.2.1.RELEASE spring-security-web@5.2.1.RELEASE	5.4.11 5.4.11

Open the chart page →

12,513

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2022-22978.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	spring-security-core@5.6.1 spring-security-web@5.6.1	5.6.4 5.6.4

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2022-22978.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	spring-security-core@5.6.1 spring-security-web@5.6.1	5.6.4 5.6.4

Open the chart page →

28,605

Container images carrying it

76 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
apache/shenyu-bootstrap :2.4.2	0bd3b25c4be4	spring-security-core@5.2.1.RELEASE spring-security-web@5.2.1.RELEASE	5.4.11 5.4.11	3
geoservercloud/geoserver-cloud-rest :1.0-RC3	99540eef78ad	spring-security-core@5.3.4.RELEASE spring-security-web@5.3.4.RELEASE	5.4.11 5.4.11	2
geoservercloud/geoserver-cloud-wcs :1.0-RC3	5c254c53a357	spring-security-core@5.3.4.RELEASE spring-security-web@5.3.4.RELEASE	5.4.11 5.4.11	2
geoservercloud/geoserver-cloud-webui :1.0-RC3	c687b1cbc891	spring-security-core@5.3.4.RELEASE spring-security-web@5.3.4.RELEASE	5.4.11 5.4.11	2
geoservercloud/geoserver-cloud-wfs :1.0-RC3	5288f320cf36	spring-security-core@5.3.4.RELEASE spring-security-web@5.3.4.RELEASE	5.4.11 5.4.11	2
geoservercloud/geoserver-cloud-wms :1.0-RC3	a30a60ac6cd0	spring-security-core@5.3.4.RELEASE spring-security-web@5.3.4.RELEASE	5.4.11 5.4.11	2
hookiesolutions/webhookie :latest	0629694246ba	spring-security-core@5.6.1 spring-security-web@5.6.1	5.6.4 5.6.4	2
nacos/nacos-server :v2.1.0	dcf04549c6d7	spring-security-core@5.1.12.RELEASE spring-security-web@5.1.12.RELEASE	5.4.11 5.4.11	2
scorpiobroker/scorpio :RegistrySubscriptionManager_2.1.0	01e11d800459	spring-security-core@5.6.0 spring-security-web@5.6.0	5.6.4 5.6.4	2
scorpiobroker/scorpio :eureka-server_2.1.0	3f05a113a4be	spring-security-core@5.6.0 spring-security-web@5.6.0	5.6.4 5.6.4	2
scorpiobroker/scorpio :AtContextServer_2.1.0	5073ceef2fa0	spring-security-core@5.6.0 spring-security-web@5.6.0	5.6.4 5.6.4	2
scorpiobroker/scorpio :gateway_2.1.0	62dae3dd0eeb	spring-security-core@5.6.0 spring-security-web@5.6.0	5.6.4 5.6.4	2
scorpiobroker/scorpio :RegistryManager_2.1.0	a2cfcf0947fd	spring-security-core@5.6.0 spring-security-web@5.6.0	5.6.4 5.6.4	2
scorpiobroker/scorpio :QueryManager_2.1.0	b742a53b2803	spring-security-core@5.6.0 spring-security-web@5.6.0	5.6.4 5.6.4	2
scorpiobroker/scorpio :HistoryManager_2.1.0	b7fe27a06ff5	spring-security-core@5.6.0 spring-security-web@5.6.0	5.6.4 5.6.4	2
scorpiobroker/scorpio :SubscriptionManager_2.1.0	e08036670d66	spring-security-core@5.6.0 spring-security-web@5.6.0	5.6.4 5.6.4	2
scorpiobroker/scorpio :EntityManager_2.1.0	f02e8a429a08	spring-security-core@5.6.0 spring-security-web@5.6.0	5.6.4 5.6.4	2
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	spring-security-core@5.5.0 spring-security-web@5.5.0	5.5.7 5.5.7	1
andrianrf/bpjstk-service :latest	46abe878d9d8	spring-security-core@5.3.4.RELEASE spring-security-web@5.3.4.RELEASE	5.4.11 5.4.11	1
andrianrf/iso-client :latest	ba560086ce15	spring-security-core@5.3.4.RELEASE spring-security-web@5.3.4.RELEASE	5.4.11 5.4.11	1
apache/nifi-registry :1.14.0	090b7f87ec7f	spring-security-core@5.5.0 spring-security-web@5.5.0	5.5.7 5.5.7	1
apache/nifi-registry :0.8.0	974efa2f21da	spring-security-core@5.2.2.RELEASE spring-security-web@5.2.2.RELEASE	5.4.11 5.4.11	1
atlassian/confluence-server :7.10.0	3b9222ab32ef	spring-security-core@4.2.16.RELEASE	5.4.11	1
atlassian/jira-software :8.14.0	37bc46cbec1a	spring-security-core@5.2.1.RELEASE	5.4.11	1
atlassian/jira-software :9.7.2	64a75aa4ec4e	spring-security-core@5.4.5	5.4.11	1
binhex/arch-nzbhydra2 :3.1.0-1-01	fb8952921ab6	spring-security-core@5.3.3.RELEASE spring-security-web@5.3.3.RELEASE	5.4.11 5.4.11	1
choerodon/event-store-service :0.8.0	3c94c97f6f69	spring-security-core@4.2.2.RELEASE spring-security-web@4.2.2.RELEASE	5.4.11 5.4.11	1
craigwillis/c2metadata-bd :latest	ae317d7e4724	spring-security-core@4.1.3.RELEASE spring-security-web@4.1.3.RELEASE	5.4.11 5.4.11	1
drpcorg/dshackle :0.54.0	8858fae1859d	spring-security-core@5.5.3 spring-security-web@5.5.3	5.5.7 5.5.7	1
egdsandaru/apache-ranger-admin :1.0.0	681baa1926f4	spring-security-core@4.2.17.RELEASE spring-security-web@4.2.17.RELEASE	5.4.11 5.4.11	1
elastictranscoder/media :627e21dc	963ab3858c6b	spring-security-core@5.5.0 spring-security-web@5.5.0	5.5.7 5.5.7	1
elastictranscoder/media-storage :f6d861a0	26208b8c2359	spring-security-core@5.5.0 spring-security-web@5.5.0	5.5.7 5.5.7	1
elastictranscoder/transcoder-handler :627e21dc	5b75d19e2733	spring-security-core@5.5.0 spring-security-web@5.5.0	5.5.7 5.5.7	1
emeraldpay/dshackle :0.14.0	126f0ae0b388	spring-security-core@5.5.3 spring-security-web@5.5.3	5.5.7 5.5.7	1
emeraldpay/dshackle :0.12	ac2a4bc66ab6	spring-security-core@5.5.3 spring-security-web@5.5.3	5.5.7 5.5.7	1
fimperato/sparkvid-api :1.0.5-RELEASE	604012b77841	spring-security-core@5.4.1	5.4.11	1
geonetwork/gn-cloud-ogc-api-records-service :4.2.8-0	20c9bb761f67	spring-security-core@5.3.6.RELEASE spring-security-web@5.3.6.RELEASE	5.4.11 5.4.11	1
geoservercloud/geoserver-cloud-rest :1.0-RC2	5dc0c93a1710	spring-security-core@5.3.4.RELEASE spring-security-web@5.3.4.RELEASE	5.4.11 5.4.11	1
geoservercloud/geoserver-cloud-wcs :1.0-RC2	47ae1bdb4bcc	spring-security-core@5.3.4.RELEASE spring-security-web@5.3.4.RELEASE	5.4.11 5.4.11	1
geoservercloud/geoserver-cloud-webui :1.0-RC2	28c3e5a8c5a3	spring-security-core@5.3.4.RELEASE spring-security-web@5.3.4.RELEASE	5.4.11 5.4.11	1
geoservercloud/geoserver-cloud-wfs :1.0-RC2	8c70ee06d5ab	spring-security-core@5.3.4.RELEASE spring-security-web@5.3.4.RELEASE	5.4.11 5.4.11	1
geoservercloud/geoserver-cloud-wms :1.0-RC2	42775ba6a4da	spring-security-core@5.3.4.RELEASE spring-security-web@5.3.4.RELEASE	5.4.11 5.4.11	1
gocd/gocd-server :v19.3.0	2da45cb09d57	spring-security-core@4.2.11.RELEASE spring-security-web@4.2.11.RELEASE	5.4.11 5.4.11	1
gocd/gocd-server :v26.1.0	720d1012b93f	spring-security-core@4.2.20.RELEASE spring-security-web@4.2.20.RELEASE	5.4.11 5.4.11	1
gotson/komga :0.99.4	9b15ea6bfc30	spring-security-core@5.5.0 spring-security-web@5.4.6	5.5.7 5.4.11	1
gurolakman/smsf-configuration :1.0.4	9abb3882bcbd	spring-security-core@5.6.2 spring-security-web@5.6.2	5.6.4 5.6.4	1
gurolakman/smsf-momt :1.0.4	ce23b20a8a17	spring-security-core@5.6.2 spring-security-web@5.6.2	5.6.4 5.6.4	1
gurolakman/smsf-registration :1.0.4	b22e746edd5d	spring-security-core@5.6.2 spring-security-web@5.6.2	5.6.4 5.6.4	1
gurolakman/ussigw-configuration :1.0.4	bf18525c5ad9	spring-security-core@5.6.2 spring-security-web@5.6.2	5.6.4 5.6.4	1
housewrecker/gaps :latest	f417dd0a7547	spring-security-core@5.6.2 spring-security-web@5.6.2	5.6.4 5.6.4	1