Medium severity · published Apr 14, 2022
CVE-2022-22968
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a…
5.3
CVSS
5.7%
EPSS
No
On KEV
Description
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.7% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Spring Framework ·
Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions · source: vendor, NVD
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
CS
Cloud Secure Agent · Netapp
All versions, or not specified · source: NVD
MT
Metrocluster Tiebreaker · Netapp
All versions, or not specified · source: NVD
ME
Mysql Enterprise Monitor · Oracle
through 8.0.29 · source: NVD
SC
Snap Creator Framework · Netapp
All versions, or not specified · source: NVD
SN
Snapmanager · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-22968
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-22968
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220602-0004/
Vendor Advisory
https://tanzu.vmware.com/security/cve-2022-22968
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
More from Spring Framework
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
7.5
CVE-2024-38819
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks
6.5
CVE-2022-22971
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack…
6.5
CVE-2022-22950
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of…
5.3
CVE-2022-22970
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data…