Unscored severity · published Jun 21, 2010
CVE-2010-1622
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request…
–
CVSS
52%
EPSS
No
On KEV
Description
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.
Exploitation
Is it being used?
Exploit prediction (EPSS)52.0% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FM
Fusion Middleware · Oracle
7.6.2; 11.1.1.6.1; 11.1.1.8.0 · source: NVD
SF
Spring Framework · Springsource
2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-1622
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-1622
Vendor Advisory
http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html
Vendor Advisory
http://geronimo.apache.org/21x-security-report.html
Vendor Advisory
http://geronimo.apache.org/22x-security-report.html
secunia.com
http://secunia.com/advisories/41016
secunia.com
http://secunia.com/advisories/41025
secunia.com
http://secunia.com/advisories/43087
More from Fusion Middleware
9.8
CVE-2025-61757
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
9.8
CVE-2021-35587
Oracle Fusion Middleware Unspecified Vulnerability
9.8
CVE-2020-2551
Oracle Fusion Middleware Unspecified Vulnerability
9.8
CVE-2012-1710
Oracle Fusion Middleware Unspecified Vulnerability
9.1
CVE-2012-3152
Oracle Fusion Middleware Unspecified Vulnerability