CVE-2022-23554: 
Java vulnerability analysis and mitigation

Alpine, a scaffolding library in Java, was found to contain an authentication filter bypass vulnerability (CVE-2022-23554) prior to version 1.10.4. The vulnerability was discovered and reported by GHSL team member @pwntester (Alvaro Muñoz) (GitHub Security Lab).

The vulnerability exists in the AuthenticationFilter component which relies on the request URI to evaluate if a user is accessing the swagger endpoint. By accessing a URL with a specially crafted path such as '/api/foo;%2fapi%2fswagger', an attacker could bypass the authentication filter without aborting the request. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) by GitHub and 5.4 (Medium) by NVD (NVD).

While the vulnerability allows for authentication bypass, it's important to note that the principal object will not be assigned, therefore the issue won't allow user impersonation. The vulnerability could potentially expose sensitive endpoints that should be protected by authentication (GitHub Security Lab).

The vulnerability has been fixed in Alpine version 1.10.4. Users are advised to upgrade to this version or later. No known workarounds were available for earlier versions (NVD).