Medium severity · published May 12, 2022
CVE-2022-22971
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack…
6.5
CVSS
3.2%
EPSS
No
On KEV
Description
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Spring Framework ·
Spring Framework versions 5.3.x prior to 5.3.20, 5.2.x prior to 5.2.22 and all old and unsupported versions · source: vendor, NVD
CS
Cloud Secure Agent · Netapp
All versions, or not specified · source: NVD
FS
Financial Services Crime And Compliance Management Studio · Oracle
8.0.8.2.0; 8.0.8.3.0 · source: NVD
OI
Oncommand Insight · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-22971
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-22971
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220616-0003/
Mitigation
https://tanzu.vmware.com/security/cve-2022-22971
Patch
https://www.oracle.com/security-alerts/cpujul2022.html
More from Spring Framework
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
7.5
CVE-2024-38819
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks
6.5
CVE-2022-22950
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of…
5.3
CVE-2022-22970
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data…
5.3
CVE-2022-22968
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a…