Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-22968

Good to know:

icon
icon

Date: April 14, 2022

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

Language: Java

Severity Score

Related Resources (9)

https://tanzu.vmware.com/security/cve-2022-22968
https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea
https://nvd.nist.gov/vuln/detail/CVE-2022-22968
https://www.oracle.com/security-alerts/cpujul2022.html
https://github.com/spring-projects/spring-framework
https://security.netapp.com/advisory/ntap-20220602-0004
https://github.com/spring-projects/spring-framework/commit/a7cf19cec5ebd270f97a194d749e2d5701ad2ab7
https://security.netapp.com/advisory/ntap-20220602-0004/
https://www.mend.io/vulnerability-database/CVE-2022-22968

Severity Score

Weakness Type (CWE)

Improper Handling of Case Sensitivity

CWE-178

Top Fix

icon

Upgrade Version

Upgrade to version org.springframework:spring-context:5.2.21,5.3.19

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us