Login Request a demo
High severity · published Feb 23, 2021
CVE-2021-22112
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is…
8.8
CVSS
3.3%
EPSS
No
On KEV
Description
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Communications Element Manager · Oracle
8.2.0 through 8.2.4.0 · source: NVD
CI
Communications Interactive Session Recorder · Oracle
6.3; 6.4 · source: NVD
CU
Communications Unified Inventory Management · Oracle
7.4.1 · source: NVD
HC
Hospitality Cruise Shipboard Property Management System · Oracle
20.1.0 · source: NVD
IP
Insurance Policy Administration · Oracle
11.2.0; 11.3.0 · source: NVD
ME
Mysql Enterprise Monitor · Oracle
through 8.0.25 · source: NVD
SS
Spring Security · Vmware
5.4.0 before 5.4.4 · source: NVD
Affected product
CE
Communications Element Manager
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22112
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22112
Mailing List
http://www.openwall.com/lists/oss-security/2021/02/19/7
lists.apache.org
https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14%40%3Cpluto-dev.portals.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r2cb05e499807900ba23e539643eead9c5f0652fd271f223f89da1804%40%3Cpluto-scm.portals.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r37423ec7eea340e92a409452c35b649dce02fdc467f0b3f52086c177%40%3Cpluto-dev.portals.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3%40%3Cpluto-dev.portals.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde%40%3Cpluto-dev.portals.apache.org%3E
More from Communications Element Manager
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
6.1
CVE-2020-11023
Potential XSS vulnerability in jQuery
9.8
CVE-2021-44790
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts)
9.8
CVE-2020-11998
A regression has been introduced in the commit preventing JMX re-bind
9.8
CVE-2020-11984
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE