Hiroki Nishino

The issue is related to the RegexRequestMatcher component in Spring Security, which can be misconfigured, allowing for an authorization bypass on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable. The vulnerability can be exploited by a remote attacker to elevate their privileges. The issue can be triggered using symbols such as %0d or %0a.

Name of the Vulnerable Software and Affected Versions: Optical BB unit E-WMTA2.3 Description: A cross-site request forgery (CSRF) issue allows a remote attacker to hijack the authentication of administrators via a specially crafted page. This can lead to unauthorized access to administrative functions. Recommendations: For Optical BB unit E-WMTA2.3, consider implementing proper CSRF token validation to prevent hijacking of administrator sessions. As a temporary workaround, restrict access to administrative pages to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.