Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-27772

Good to know:

icon
icon

Date: March 30, 2022

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that are no longer supported by the maintainer

Language: Java

Severity Score

Related Resources (5)

https://github.com/spring-projects/spring-boot
https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-cm59-pr5q-cw85
https://nvd.nist.gov/vuln/detail/CVE-2022-27772
https://github.com/spring-projects/spring-boot/commit/667ccdae84822072f9ea1a27ed5c77964c71002d
https://www.mend.io/vulnerability-database/CVE-2022-27772

Severity Score

Weakness Type (CWE)

Exposure of Resource to Wrong Sphere

CWE-668

Creation of Temporary File in Directory with Insecure Permissions

CWE-379

Insecure Temporary File

CWE-377

Top Fix

icon

Upgrade Version

Upgrade to version org.springframework.boot:spring-boot:2.2.11.RELEASE

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): LOCAL
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us