Dependency-Check Report

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

CWE-358 Improperly Implemented Security Check for Standard, CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CISA Known Exploited Vulnerability:

Product: VMware Spring Framework
Name: Spring Framework JDK 9+ Remote Code Execution Vulnerability
Date Added: 2022-04-04
Description: Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-25

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security@vmware.com - EXPLOIT,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@vmware.com - MITIGATION,VENDOR_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY,VDB_ENTRY

Vulnerable Software & Versions: (show all)

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - MITIGATION,VENDOR_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (4.0)
Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

NVD-CWE-noinfo

CVSSv2:

Base Score: LOW (3.6)
Vector: /AV:N/AC:H/Au:S/C:P/I:P/A:N

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N/E:1.3/RC:R/MAV:A

References:

security@pivotal.io - NOT_APPLICABLE,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - THIRD_PARTY_ADVISORY
security@pivotal.io - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:

Base Score: MEDIUM (4.0)
Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

security@vmware.com - MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

NVD-CWE-noinfo

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:2.2/RC:R/MAV:A

References:

security_alert@emc.com - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - MITIGATION,VENDOR_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

CWE-178 Improper Handling of Case Sensitivity

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:

Base Score: LOW (3.5)
Vector: /AV:N/AC:M/Au:S/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:1.6/RC:R/MAV:A

References:

security@vmware.com - MITIGATION,VENDOR_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Spring Expression Language (SpEL)

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/jenkins/.m2/repository/org/springframework/spring-expression/3.2.18.RELEASE/spring-expression-3.2.18.RELEASE.jar
MD5: 7e5fbe8696a4e71dc310c1ff9f8286e1
SHA1: 070c1fb9f2111601193e01a8d0c3ccbca1bf3706
SHA256:cde7eda6cc2270ab726f963aeb546c3f4db76746c661c247fbfb5d2a4d2f4411
Referenced In Projects/Scopes:

Gemma CLI:runtime
Gemma Core:runtime
Gemma Groovy Support:runtime
Gemma:runtime
Gemma Web:runtime
Gemma REST:runtime

pkg:maven/gemma/gemma-web@1.31.6
pkg:maven/gemma/gemma-core@1.31.6
pkg:maven/gemma/gemma@1.31.6
pkg:maven/gemma/gemma-rest@1.31.6
pkg:maven/gemma/gemma-groovy-support@1.31.6
pkg:maven/gemma/gemma-cli@1.31.6

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-expression	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	expression	Highest
Vendor	jar	package name	spel	Highest
Vendor	jar	package name	springframework	Highest
Vendor	pom	artifactid	spring-expression	Highest
Vendor	pom	artifactid	spring-expression	Low
Vendor	pom	developer email	jhoeller@gopivotal.com	Low
Vendor	pom	developer id	jhoeller	Medium
Vendor	pom	developer name	Juergen Hoeller	Medium
Vendor	pom	groupid	org.springframework	Highest
Vendor	pom	name	Spring Expression Language (SpEL)	High
Vendor	pom	organization name	SpringSource	High
Vendor	pom	organization url	http://springsource.org/spring-framework	Medium
Vendor	pom	url	SpringSource/spring-framework	Highest
Product	file	name	spring-expression	High
Product	hint analyzer	product	springsource_spring_framework	Highest
Product	jar	package name	expression	Highest
Product	jar	package name	spel	Highest
Product	jar	package name	springframework	Highest
Product	Manifest	Implementation-Title	spring-expression	High
Product	pom	artifactid	spring-expression	Highest
Product	pom	developer email	jhoeller@gopivotal.com	Low
Product	pom	developer id	jhoeller	Low
Product	pom	developer name	Juergen Hoeller	Low
Product	pom	groupid	org.springframework	Highest
Product	pom	name	Spring Expression Language (SpEL)	High
Product	pom	organization name	SpringSource	Low
Product	pom	organization url	http://springsource.org/spring-framework	Low
Product	pom	url	SpringSource/spring-framework	High
Version	Manifest	Implementation-Version	3.2.18.RELEASE	High
Version	pom	version	3.2.18.RELEASE	Highest

Identifiers

pkg:maven/org.springframework/spring-expression@3.2.18.RELEASE (Confidence:High)
cpe:2.3:a:pivotal_software:spring_framework:3.2.18:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:springsource:spring_framework:3.2.18:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_framework:3.2.18:release:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

CWE-358 Improperly Implemented Security Check for Standard, CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

OSSINDEX - [CVE-2018-1270] CWE-358: Improperly Implemented Security Check for Standard
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1270
OSSIndex - http://www.polaris-lab.com/index.php/archives/501/
OSSIndex - https://chybeta.github.io/2018/04/07/spring-messaging-Remote-Code-Execution-%E5%88%86%E6%9E%90-%E3%80%90CVE-2018-1270%E3%80%91/
OSSIndex - https://jira.spring.io/browse/SPR-16588
security_alert@emc.com - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CISA Known Exploited Vulnerability:

Product: VMware Spring Framework
Name: Spring Framework JDK 9+ Remote Code Execution Vulnerability
Date Added: 2022-04-04
Description: Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-25

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security@vmware.com - EXPLOIT,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@vmware.com - MITIGATION,VENDOR_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY,VDB_ENTRY

Vulnerable Software & Versions: (show all)

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - MITIGATION,VENDOR_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (4.0)
Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

OSSINDEX - [CVE-2018-1257] CWE-20: Improper Input Validation
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1257
OSSIndex - https://jira.spring.io/browse/SPR-16731
OSSIndex - https://pivotal.io/security/cve-2018-1257
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

NVD-CWE-noinfo

CVSSv2:

Base Score: LOW (3.6)
Vector: /AV:N/AC:H/Au:S/C:P/I:P/A:N

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N/E:1.3/RC:R/MAV:A

References:

security@pivotal.io - NOT_APPLICABLE,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - THIRD_PARTY_ADVISORY
security@pivotal.io - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:

Base Score: MEDIUM (4.0)
Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

OSSINDEX - [CVE-2022-22950] CWE-770: Allocation of Resources Without Limits or Throttling
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-22950
OSSIndex - https://github.com/spring-projects/spring-framework/issues/28145
OSSIndex - https://spring.io/blog/2022/03/17/spring-framework-6-0-0-m3-and-5-3-17-available-now
OSSIndex - https://tanzu.vmware.com/security/cve-2022-22950
security@vmware.com - MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

NVD-CWE-noinfo

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

OSSINDEX - [CVE-2023-20861] CWE-noinfo
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-20861
OSSIndex - https://spring.io/blog/2023/03/20/spring-framework-5-2-23-fixes-cve-2023-20861
OSSIndex - https://spring.io/security/cve-2023-20861
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2023-20863 (OSSINDEX)

In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:org.springframework:spring-expression:3.2.18.RELEASE:*:*:*:*:*:*:*

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:2.2/RC:R/MAV:A

References:

security_alert@emc.com - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - MITIGATION,VENDOR_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

CWE-178 Improper Handling of Case Sensitivity

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:

Base Score: LOW (3.5)
Vector: /AV:N/AC:M/Au:S/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:1.6/RC:R/MAV:A

References:

security@vmware.com - MITIGATION,VENDOR_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Spring Object/XML Marshalling

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/jenkins/.m2/repository/org/springframework/spring-oxm/3.2.4.RELEASE/spring-oxm-3.2.4.RELEASE.jar
MD5: 2abb980787ce24a67a9496172cef65cf
SHA1: 1de9e0537d7ea233668540577e72d86ff6df6d8b
SHA256:fc259b1b0946c862527c5714dca66f6e884ce8249b35d146bed0fa66d553b1e8
Referenced In Project/Scope: Gemma Web:compile
pkg:maven/org.springframework.ws/spring-ws-core@2.1.4.RELEASE

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-oxm	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	oxm	Highest
Vendor	jar	package name	springframework	Highest
Vendor	pom	artifactid	spring-oxm	Highest
Vendor	pom	artifactid	spring-oxm	Low
Vendor	pom	developer email	jhoeller@vmware.com	Low
Vendor	pom	developer id	jhoeller	Medium
Vendor	pom	developer name	Juergen Hoeller	Medium
Vendor	pom	groupid	org.springframework	Highest
Vendor	pom	name	Spring Object/XML Marshalling	High
Vendor	pom	organization name	SpringSource	High
Vendor	pom	organization url	http://springsource.org/spring-framework	Medium
Vendor	pom	url	SpringSource/spring-framework	Highest
Product	file	name	spring-oxm	High
Product	hint analyzer	product	springsource_spring_framework	Highest
Product	jar	package name	oxm	Highest
Product	jar	package name	springframework	Highest
Product	Manifest	Implementation-Title	spring-oxm	High
Product	pom	artifactid	spring-oxm	Highest
Product	pom	developer email	jhoeller@vmware.com	Low
Product	pom	developer id	jhoeller	Low
Product	pom	developer name	Juergen Hoeller	Low
Product	pom	groupid	org.springframework	Highest
Product	pom	name	Spring Object/XML Marshalling	High
Product	pom	organization name	SpringSource	Low
Product	pom	organization url	http://springsource.org/spring-framework	Low
Product	pom	url	SpringSource/spring-framework	High
Version	Manifest	Implementation-Version	3.2.4.RELEASE	High
Version	pom	version	3.2.4.RELEASE	Highest

Identifiers

pkg:maven/org.springframework/spring-oxm@3.2.4.RELEASE (Confidence:High)
cpe:2.3:a:pivotal_software:spring_framework:3.2.4:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:springsource:spring_framework:3.2.4:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_framework:3.2.4:release:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

CWE-358 Improperly Implemented Security Check for Standard, CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CISA Known Exploited Vulnerability:

Product: VMware Spring Framework
Name: Spring Framework JDK 9+ Remote Code Execution Vulnerability
Date Added: 2022-04-04
Description: Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-25

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security@vmware.com - EXPLOIT,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@vmware.com - MITIGATION,VENDOR_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY,VDB_ENTRY

Vulnerable Software & Versions: (show all)

CVE-2015-5211

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.

CWE-552 Files or Directories Accessible to External Parties

CVSSv2:

Base Score: HIGH (9.3)
Vector: /AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: CRITICAL (9.6)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:2.8/RC:R/MAV:A

References:

security_alert@emc.com - EXPLOIT,TECHNICAL_DESCRIPTION
security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0225

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

CWE-611 Improper Restriction of XML External Entity Reference

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: HIGH (8.8)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:2.8/RC:R/MAV:A

References:

OSSINDEX - [CVE-2014-0225] CWE-611: Improper Restriction of XML External Entity Reference ('XXE')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0225
OSSIndex - https://jira.spring.io/browse/SPR-11768
OSSIndex - https://pivotal.io/security/cve-2014-0225
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2016-9878

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - MITIGATION,VENDOR_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-6429

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.

CWE-611 Improper Restriction of XML External Entity Reference, CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0054

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

OSSINDEX - [CVE-2014-0054] CWE-352: Cross-Site Request Forgery (CSRF)
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0054
OSSIndex - https://jira.spring.io/browse/SPR-11376
OSSIndex - https://pivotal.io/security/cve-2014-0054
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (4.0)
Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

NVD-CWE-noinfo

CVSSv2:

Base Score: LOW (3.6)
Vector: /AV:N/AC:H/Au:S/C:P/I:P/A:N

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N/E:1.3/RC:R/MAV:A

References:

security@pivotal.io - NOT_APPLICABLE,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - THIRD_PARTY_ADVISORY
security@pivotal.io - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:

Base Score: MEDIUM (4.0)
Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

security@vmware.com - MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

NVD-CWE-noinfo

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:2.2/RC:R/MAV:A

References:

security_alert@emc.com - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - MITIGATION,VENDOR_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2015-3192

Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (5.5)
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:1.8/RC:R/MAV:A

References:

OSSINDEX - [CVE-2015-3192] CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
OSSIndex - http://pivotal.io/security/cve-2015-3192
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3192
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

CWE-178 Improper Handling of Case Sensitivity

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:

Base Score: LOW (3.5)
Vector: /AV:N/AC:M/Au:S/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:1.6/RC:R/MAV:A

References:

security@vmware.com - MITIGATION,VENDOR_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-3578

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

secalert@redhat.com - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-3625

Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-1904

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

cve@mitre.org - BROKEN_LINK
cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY
cve@mitre.org - PATCH,THIRD_PARTY_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - PERMISSIONS_REQUIRED
cve@mitre.org - PERMISSIONS_REQUIRED
cve@mitre.org - THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY,VDB_ENTRY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Spring Retry provides an abstraction around retrying failed operations, with an emphasis on declarative control of the process and policy-based bahaviour that is easy to extend and customize.  For instance, you can configure a plain POJO operation to retry if it fails, based on the type of exception, and with a fixed or exponential backoff.

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/jenkins/.m2/repository/org/springframework/retry/spring-retry/1.0.3.RELEASE/spring-retry-1.0.3.RELEASE.jar
MD5: 5d5f5046b698320b27d4f86285928a34
SHA1: 33b967f6abaa0a496318bff2ce96e6da6285a54d
SHA256:d8f2fd2339e794f4dd78e29d44b33f1f0b5fa687525abee8e7246f61d9cd9fca
Referenced In Projects/Scopes:

Gemma Groovy Support:compile
Gemma Core:compile
Gemma CLI:compile
Gemma REST:compile
Gemma Web:compile

pkg:maven/gemma/gemma-core@1.31.6
pkg:maven/gemma/gemma-core@1.31.6
pkg:maven/gemma/gemma-core@1.31.6
pkg:maven/gemma/gemma-core@1.31.6
pkg:maven/gemma/gemma-core@1.31.6

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-retry	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	backoff	Highest
Vendor	jar	package name	policy	Highest
Vendor	jar	package name	retry	Highest
Vendor	jar	package name	springframework	Highest
Vendor	Manifest	bundle-symbolicname	org.springframework.retry	Medium
Vendor	pom	artifactid	spring-retry	Highest
Vendor	pom	artifactid	spring-retry	Low
Vendor	pom	developer email	dsyer@vmware.com	Low
Vendor	pom	developer id	dsyer	Medium
Vendor	pom	developer name	Dave Syer	Medium
Vendor	pom	groupid	org.springframework.retry	Highest
Vendor	pom	name	Spring Retry	High
Vendor	pom	organization name	SpringSource	High
Vendor	pom	organization url	http://www.springsource.com	Medium
Vendor	pom	url	http://www.springsource.org	Highest
Product	file	name	spring-retry	High
Product	jar	package name	backoff	Highest
Product	jar	package name	policy	Highest
Product	jar	package name	retry	Highest
Product	jar	package name	springframework	Highest
Product	Manifest	Bundle-Name	Spring Retry	Medium
Product	Manifest	bundle-symbolicname	org.springframework.retry	Medium
Product	pom	artifactid	spring-retry	Highest
Product	pom	developer email	dsyer@vmware.com	Low
Product	pom	developer id	dsyer	Low
Product	pom	developer name	Dave Syer	Low
Product	pom	groupid	org.springframework.retry	Highest
Product	pom	name	Spring Retry	High
Product	pom	organization name	SpringSource	Low
Product	pom	organization url	http://www.springsource.com	Low
Product	pom	url	http://www.springsource.org	Medium
Version	Manifest	Bundle-Version	1.0.3.RELEASE	High
Version	pom	version	1.0.3.RELEASE	Highest

Identifiers

pkg:maven/org.springframework.retry/spring-retry@1.0.3.RELEASE (Confidence:High)

Description:

spring-security-acl

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/jenkins/.m2/repository/org/springframework/security/spring-security-acl/3.2.10.RELEASE/spring-security-acl-3.2.10.RELEASE.jar
MD5: f87a9ef5d7952bc6f8096b3223d67e19
SHA1: 0417714b1b6c7f11cb6c2a5ee4c3738d43353928
SHA256:7916014dbd3c61585d92aeb14e4c74584c60b7858bfb8e63b2af4560d1955315
Referenced In Projects/Scopes:

Gemma Groovy Support:compile
Gemma Core:compile
Gemma:compile
Gemma CLI:compile
Gemma REST:compile
Gemma Web:compile

pkg:maven/gemma/gemma-core@1.31.6
pkg:maven/gemma/gemma-cli@1.31.6
pkg:maven/gemma/gemma-web@1.31.6
pkg:maven/gemma/gemma@1.31.6
pkg:maven/gemma/gemma-groovy-support@1.31.6
pkg:maven/gemma/gemma-rest@1.31.6

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-security-acl	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	acls	Low
Vendor	jar	package name	security	Highest
Vendor	jar	package name	security	Low
Vendor	jar	package name	springframework	Highest
Vendor	jar	package name	springframework	Low
Vendor	pom	artifactid	spring-security-acl	Highest
Vendor	pom	artifactid	spring-security-acl	Low
Vendor	pom	developer email	rwinch@gopivotal.com	Low
Vendor	pom	developer id	rwinch	Medium
Vendor	pom	developer name	Rob Winch	Medium
Vendor	pom	groupid	org.springframework.security	Highest
Vendor	pom	name	spring-security-acl	High
Vendor	pom	organization name	spring.io	High
Vendor	pom	organization url	http://spring.io/	Medium
Vendor	pom	url	http://spring.io/spring-security	Highest
Product	file	name	spring-security-acl	High
Product	jar	package name	acls	Low
Product	jar	package name	security	Highest
Product	jar	package name	security	Low
Product	jar	package name	springframework	Highest
Product	pom	artifactid	spring-security-acl	Highest
Product	pom	developer email	rwinch@gopivotal.com	Low
Product	pom	developer id	rwinch	Low
Product	pom	developer name	Rob Winch	Low
Product	pom	groupid	org.springframework.security	Highest
Product	pom	name	spring-security-acl	High
Product	pom	organization name	spring.io	Low
Product	pom	organization url	http://spring.io/	Low
Product	pom	url	http://spring.io/spring-security	Medium
Version	pom	version	3.2.10.RELEASE	Highest

Related Dependencies

Identifiers

pkg:maven/org.springframework.security/spring-security-acl@3.2.10.RELEASE (Confidence:High)
cpe:2.3:a:pivotal_software:spring_security:3.2.10:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_security:3.2.10:release:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

CWE-863 Incorrect Authorization

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.

NVD-CWE-noinfo

CVSSv2:

Base Score: HIGH (9.0)
Vector: /AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:2.8/RC:R/MAV:A

References:

security@vmware.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.

CWE-190 Integer Overflow or Wraparound

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security@vmware.com - MITIGATION,VENDOR_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

spring-security-config

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/jenkins/.m2/repository/org/springframework/security/spring-security-config/3.2.10.RELEASE/spring-security-config-3.2.10.RELEASE.jar
MD5: 8c8534526c1ed31e3cdc65523e782e3c
SHA1: c8c9c742067d5a4879bf8db289cb48b60262056a
SHA256:f8849bb9e245423924ccdaee6693d497f1b4d2dd2069e7695d4fdd2b82a2f5b3
Referenced In Projects/Scopes:

Gemma CLI:runtime
Gemma Core:runtime
Gemma Groovy Support:runtime
Gemma:runtime
Gemma Web:runtime
Gemma REST:runtime

pkg:maven/gemma/gemma-groovy-support@1.31.6
pkg:maven/gemma/gemma-core@1.31.6
pkg:maven/gemma/gemma-cli@1.31.6
pkg:maven/gemma/gemma@1.31.6
pkg:maven/gemma/gemma-rest@1.31.6
pkg:maven/gemma/gemma-web@1.31.6

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-security-config	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	config	Highest
Vendor	jar	package name	config	Low
Vendor	jar	package name	security	Highest
Vendor	jar	package name	security	Low
Vendor	jar	package name	springframework	Highest
Vendor	jar	package name	springframework	Low
Vendor	pom	artifactid	spring-security-config	Highest
Vendor	pom	artifactid	spring-security-config	Low
Vendor	pom	developer email	rwinch@gopivotal.com	Low
Vendor	pom	developer id	rwinch	Medium
Vendor	pom	developer name	Rob Winch	Medium
Vendor	pom	groupid	org.springframework.security	Highest
Vendor	pom	name	spring-security-config	High
Vendor	pom	organization name	spring.io	High
Vendor	pom	organization url	http://spring.io/	Medium
Vendor	pom	url	http://spring.io/spring-security	Highest
Product	file	name	spring-security-config	High
Product	jar	package name	annotation	Low
Product	jar	package name	config	Highest
Product	jar	package name	config	Low
Product	jar	package name	security	Highest
Product	jar	package name	security	Low
Product	jar	package name	springframework	Highest
Product	pom	artifactid	spring-security-config	Highest
Product	pom	developer email	rwinch@gopivotal.com	Low
Product	pom	developer id	rwinch	Low
Product	pom	developer name	Rob Winch	Low
Product	pom	groupid	org.springframework.security	Highest
Product	pom	name	spring-security-config	High
Product	pom	organization name	spring.io	Low
Product	pom	organization url	http://spring.io/	Low
Product	pom	url	http://spring.io/spring-security	Medium
Version	pom	version	3.2.10.RELEASE	Highest

Identifiers

pkg:maven/org.springframework.security/spring-security-config@3.2.10.RELEASE (Confidence:High)
cpe:2.3:a:pivotal_software:spring_security:3.2.10:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_security:3.2.10:release:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

CWE-863 Incorrect Authorization

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.

NVD-CWE-noinfo

CVSSv2:

Base Score: HIGH (9.0)
Vector: /AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:2.8/RC:R/MAV:A

References:

OSSINDEX - [CVE-2021-22112] CWE-noinfo
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-22112
OSSIndex - https://github.com/spring-projects/spring-security/issues/9387
OSSIndex - https://tanzu.vmware.com/security/cve-2021-22112
security@vmware.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

OSSINDEX - [CVE-2016-5007] CWE-264: Permissions, Privileges, and Access Controls
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5007
OSSIndex - https://jira.spring.io/browse/SEC-2534
OSSIndex - https://pivotal.io/security/cve-2016-5007
OSSIndex - https://spring.io/blog/2016/07/08/cve-2016-5007-spring-security-mvc-path-matching-inconsistency
security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2023-20862 (OSSINDEX)

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.

Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2023-20862 for details

CWE-459 Incomplete Cleanup

CVSSv3:

Base Score: MEDIUM (6.300000190734863)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References:

OSSINDEX - [CVE-2023-20862] CWE-459: Incomplete Cleanup
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-20862
OSSIndex - https://spring.io/security/cve-2023-20862

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:org.springframework.security:spring-security-config:3.2.10.RELEASE:*:*:*:*:*:*:*

CVE-2018-1199 (OSSINDEX)

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.

CWE-20 Improper Input Validation

CVSSv3:

Base Score: MEDIUM (5.300000190734863)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

OSSINDEX - [CVE-2018-1199] CWE-20: Improper Input Validation
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1199
OSSIndex - https://pivotal.io/security/cve-2018-1199

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:org.springframework.security:spring-security-config:3.2.10.RELEASE:*:*:*:*:*:*:*

Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.

CWE-190 Integer Overflow or Wraparound

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security@vmware.com - MITIGATION,VENDOR_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

spring-security-core

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/jenkins/.m2/repository/org/springframework/security/spring-security-core/3.2.10.RELEASE/spring-security-core-3.2.10.RELEASE.jar
MD5: 86427a3f1e565f975b48cb8b9be4649d
SHA1: e8018fab2ada266288d1db83cc4e452de1e2ed1c
SHA256:10443ef19e3cbe2b82197983d7fa0dec5bebd40dc3ca2c0cf02864359cdc2c93
Referenced In Projects/Scopes:

Gemma Groovy Support:compile
Gemma Core:compile
Gemma:compile
Gemma CLI:compile
Gemma REST:compile
Gemma Web:compile

pkg:maven/gemma/gemma@1.31.6
pkg:maven/gemma/gemma-core@1.31.6
pkg:maven/gemma/gemma-web@1.31.6
pkg:maven/gemma/gemma-cli@1.31.6
pkg:maven/gemma/gemma-rest@1.31.6
pkg:maven/gemma/gemma-groovy-support@1.31.6

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-security-core	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	security	Highest
Vendor	jar	package name	security	Low
Vendor	jar	package name	springframework	Highest
Vendor	jar	package name	springframework	Low
Vendor	pom	artifactid	spring-security-core	Highest
Vendor	pom	artifactid	spring-security-core	Low
Vendor	pom	developer email	rwinch@gopivotal.com	Low
Vendor	pom	developer id	rwinch	Medium
Vendor	pom	developer name	Rob Winch	Medium
Vendor	pom	groupid	org.springframework.security	Highest
Vendor	pom	name	spring-security-core	High
Vendor	pom	organization name	spring.io	High
Vendor	pom	organization url	http://spring.io/	Medium
Vendor	pom	url	http://spring.io/spring-security	Highest
Product	file	name	spring-security-core	High
Product	jar	package name	core	Highest
Product	jar	package name	security	Highest
Product	jar	package name	security	Low
Product	jar	package name	springframework	Highest
Product	pom	artifactid	spring-security-core	Highest
Product	pom	developer email	rwinch@gopivotal.com	Low
Product	pom	developer id	rwinch	Low
Product	pom	developer name	Rob Winch	Low
Product	pom	groupid	org.springframework.security	Highest
Product	pom	name	spring-security-core	High
Product	pom	organization name	spring.io	Low
Product	pom	organization url	http://spring.io/	Low
Product	pom	url	http://spring.io/spring-security	Medium
Version	pom	version	3.2.10.RELEASE	Highest

Identifiers

pkg:maven/org.springframework.security/spring-security-core@3.2.10.RELEASE (Confidence:High)
cpe:2.3:a:pivotal_software:spring_security:3.2.10:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_security:3.2.10:release:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

CWE-863 Incorrect Authorization

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.

NVD-CWE-noinfo

CVSSv2:

Base Score: HIGH (9.0)
Vector: /AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:2.8/RC:R/MAV:A

References:

OSSINDEX - [CVE-2021-22112] CWE-noinfo
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-22112
OSSIndex - https://github.com/spring-projects/spring-security/issues/9387
OSSIndex - https://tanzu.vmware.com/security/cve-2021-22112
security@vmware.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2024-22257 (OSSINDEX)

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 
5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, 
versions 6.2.x prior to 6.2.3, an application is possible vulnerable to 
broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

CWE-1390 Weak Authentication

CVSSv3:

Base Score: HIGH (8.199999809265137)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References:

OSSINDEX - [CVE-2024-22257] CWE-1390
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22257
OSSIndex - https://github.com/advisories/GHSA-f3jh-qvm4-mg39
OSSIndex - https://spring.io/security/cve-2024-22257

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:org.springframework.security:spring-security-core:3.2.10.RELEASE:*:*:*:*:*:*:*

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

OSSINDEX - [CVE-2016-5007] CWE-264: Permissions, Privileges, and Access Controls
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5007
OSSIndex - https://jira.spring.io/browse/SEC-2534
OSSIndex - https://pivotal.io/security/cve-2016-5007
OSSIndex - https://spring.io/blog/2016/07/08/cve-2016-5007-spring-security-mvc-path-matching-inconsistency
security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2019-11272 (OSSINDEX)

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".

CWE-522 Insufficiently Protected Credentials

CVSSv3:

Base Score: HIGH (7.300000190734863)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References:

OSSINDEX - [CVE-2019-11272] CWE-522: Insufficiently Protected Credentials
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-11272
OSSIndex - https://github.com/spring-projects/spring-security/issues/7023
OSSIndex - https://pivotal.io/security/cve-2019-11272
OSSIndex - https://sagan-production.cfapps.io/blog/2019/06/19/cve-2019-11272-spring-security-4-2-13-released

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:org.springframework.security:spring-security-core:3.2.10.RELEASE:*:*:*:*:*:*:*

CVE-2019-3795 (OSSINDEX)

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.

Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2019-3795 for details

CWE-330 Use of Insufficiently Random Values

CVSSv3:

Base Score: MEDIUM (5.300000190734863)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

OSSINDEX - [CVE-2019-3795] CWE-330: Use of Insufficiently Random Values
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-3795
OSSIndex - https://pivotal.io/security/cve-2019-3795

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:org.springframework.security:spring-security-core:3.2.10.RELEASE:*:*:*:*:*:*:*

Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.

CWE-190 Integer Overflow or Wraparound

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security@vmware.com - MITIGATION,VENDOR_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

spring-security-web

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/jenkins/.m2/repository/org/springframework/security/spring-security-web/3.2.10.RELEASE/spring-security-web-3.2.10.RELEASE.jar
MD5: 22b94b4f676727805952091f92cd60f5
SHA1: b925996ca5a7310e3315705cd2b69a15214ee3e1
SHA256:84b59931956693916e744977cec02db88fcd17eb11f47081d46b7fdc5196b1dd
Referenced In Projects/Scopes:

Gemma REST:compile
Gemma Web:compile

pkg:maven/gemma/gemma-rest@1.31.6
pkg:maven/gemma/gemma-web@1.31.6

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-security-web	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	security	Highest
Vendor	jar	package name	security	Low
Vendor	jar	package name	springframework	Highest
Vendor	jar	package name	springframework	Low
Vendor	jar	package name	web	Highest
Vendor	jar	package name	web	Low
Vendor	pom	artifactid	spring-security-web	Highest
Vendor	pom	artifactid	spring-security-web	Low
Vendor	pom	developer email	rwinch@gopivotal.com	Low
Vendor	pom	developer id	rwinch	Medium
Vendor	pom	developer name	Rob Winch	Medium
Vendor	pom	groupid	org.springframework.security	Highest
Vendor	pom	name	spring-security-web	High
Vendor	pom	organization name	spring.io	High
Vendor	pom	organization url	http://spring.io/	Medium
Vendor	pom	url	http://spring.io/spring-security	Highest
Product	file	name	spring-security-web	High
Product	jar	package name	security	Highest
Product	jar	package name	security	Low
Product	jar	package name	springframework	Highest
Product	jar	package name	web	Highest
Product	jar	package name	web	Low
Product	pom	artifactid	spring-security-web	Highest
Product	pom	developer email	rwinch@gopivotal.com	Low
Product	pom	developer id	rwinch	Low
Product	pom	developer name	Rob Winch	Low
Product	pom	groupid	org.springframework.security	Highest
Product	pom	name	spring-security-web	High
Product	pom	organization name	spring.io	Low
Product	pom	organization url	http://spring.io/	Low
Product	pom	url	http://spring.io/spring-security	Medium
Version	pom	version	3.2.10.RELEASE	Highest

Identifiers

pkg:maven/org.springframework.security/spring-security-web@3.2.10.RELEASE (Confidence:High)
cpe:2.3:a:pivotal_software:spring_security:3.2.10:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_security:3.2.10:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:web_project:web:3.2.10:release:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

CWE-863 Incorrect Authorization

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.

NVD-CWE-noinfo

CVSSv2:

Base Score: HIGH (9.0)
Vector: /AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:2.8/RC:R/MAV:A

References:

OSSINDEX - [CVE-2021-22112] CWE-noinfo
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-22112
OSSIndex - https://github.com/spring-projects/spring-security/issues/9387
OSSIndex - https://tanzu.vmware.com/security/cve-2021-22112
security@vmware.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

OSSINDEX - [CVE-2016-5007] CWE-264: Permissions, Privileges, and Access Controls
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5007
OSSIndex - https://jira.spring.io/browse/SEC-2534
OSSIndex - https://pivotal.io/security/cve-2016-5007
OSSIndex - https://spring.io/blog/2016/07/08/cve-2016-5007-spring-security-mvc-path-matching-inconsistency
security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2016-9879 (OSSINDEX)

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath(), and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected.

CWE-417 Communication Channel Errors

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

OSSINDEX - [CVE-2016-9879] CWE-417
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9879
OSSIndex - https://pivotal.io/security/cve-2016-9879

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:org.springframework.security:spring-security-web:3.2.10.RELEASE:*:*:*:*:*:*:*

CVE-2023-20862 (OSSINDEX)

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.

Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2023-20862 for details

CWE-459 Incomplete Cleanup

CVSSv3:

Base Score: MEDIUM (6.300000190734863)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References:

OSSINDEX - [CVE-2023-20862] CWE-459: Incomplete Cleanup
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-20862
OSSIndex - https://spring.io/security/cve-2023-20862

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:org.springframework.security:spring-security-web:3.2.10.RELEASE:*:*:*:*:*:*:*

CVE-2018-1199 (OSSINDEX)

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.

CWE-20 Improper Input Validation

CVSSv3:

Base Score: MEDIUM (5.300000190734863)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

OSSINDEX - [CVE-2018-1199] CWE-20: Improper Input Validation
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1199
OSSIndex - https://pivotal.io/security/cve-2018-1199

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:org.springframework.security:spring-security-web:3.2.10.RELEASE:*:*:*:*:*:*:*

Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.

CWE-190 Integer Overflow or Wraparound

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security@vmware.com - MITIGATION,VENDOR_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Foundational module containing the ServiceProvider Connect Framework and Service API invocation support.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/jenkins/.m2/repository/org/springframework/social/spring-social-core/1.0.3.RELEASE/spring-social-core-1.0.3.RELEASE.jar
MD5: 5e3390fe11574f09c63be485eea284c7
SHA1: 44e648f23b45162c698e255a16759832dfcfc004
SHA256:07729c0ba458698cd1047a017894c5084d79aaf5cf1ccafb75710ad6e0c230c1
Referenced In Project/Scope: Gemma Web:runtime
pkg:maven/gemma/gemma-web@1.31.6

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-social-core	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	connect	Highest
Vendor	jar	package name	serviceprovider	Highest
Vendor	jar	package name	social	Highest
Vendor	jar	package name	springframework	Highest
Vendor	jar	package name	support	Highest
Vendor	pom	artifactid	spring-social-core	Highest
Vendor	pom	artifactid	spring-social-core	Low
Vendor	pom	developer email	cwalls@vmware.com	Low
Vendor	pom	developer id	cwalls	Medium
Vendor	pom	developer name	Craig Walls	Medium
Vendor	pom	groupid	org.springframework.social	Highest
Vendor	pom	name	Foundational module containing the ServiceProvider Connect Framework and Service API invocation support.	High
Vendor	pom	organization name	SpringSource	High
Vendor	pom	organization url	http://springsource.org/spring-social	Medium
Vendor	pom	url	SpringSource/spring-social	Highest
Product	file	name	spring-social-core	High
Product	jar	package name	connect	Highest
Product	jar	package name	serviceprovider	Highest
Product	jar	package name	social	Highest
Product	jar	package name	springframework	Highest
Product	jar	package name	support	Highest
Product	Manifest	Implementation-Title	spring-social-core	High
Product	pom	artifactid	spring-social-core	Highest
Product	pom	developer email	cwalls@vmware.com	Low
Product	pom	developer id	cwalls	Low
Product	pom	developer name	Craig Walls	Low
Product	pom	groupid	org.springframework.social	Highest
Product	pom	name	Foundational module containing the ServiceProvider Connect Framework and Service API invocation support.	High
Product	pom	organization name	SpringSource	Low
Product	pom	organization url	http://springsource.org/spring-social	Low
Product	pom	url	SpringSource/spring-social	High
Version	Manifest	Implementation-Version	1.0.3.RELEASE	High
Version	pom	version	1.0.3.RELEASE	Highest

Identifiers

pkg:maven/org.springframework.social/spring-social-core@1.0.3.RELEASE (Confidence:High)
cpe:2.3:a:vmware:spring_social:1.0.3:release:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

CVE-2015-5258

Cross-site request forgery (CSRF) vulnerability in springframework-social before 1.1.3.

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:2.8/RC:R/MAV:A

References:

secalert@redhat.com - ISSUE_TRACKING,THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:vmware:spring_social:*:*:*:*:*:*:*:* versions up to (excluding) 1.1.3

Description:

Spring Web

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/jenkins/.m2/repository/org/springframework/spring-web/3.2.18.RELEASE/spring-web-3.2.18.RELEASE.jar
MD5: c3435c31fea5f1e479b4bb5eba32133d
SHA1: bc0bdade0a7a52b8fae88e1febc8479383a2acad
SHA256:0aa220d3703eaf6eff670423978566a2af506fb9ea8bb728fa05bb16bdc74e9c
Referenced In Projects/Scopes:

Gemma REST:compile
Gemma Web:compile

pkg:maven/gemma/gemma-web@1.31.6
pkg:maven/org.springframework/spring-webmvc@3.2.18.RELEASE

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-web	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	springframework	Highest
Vendor	jar	package name	web	Highest
Vendor	pom	artifactid	spring-web	Highest
Vendor	pom	artifactid	spring-web	Low
Vendor	pom	developer email	jhoeller@gopivotal.com	Low
Vendor	pom	developer id	jhoeller	Medium
Vendor	pom	developer name	Juergen Hoeller	Medium
Vendor	pom	groupid	org.springframework	Highest
Vendor	pom	name	Spring Web	High
Vendor	pom	organization name	SpringSource	High
Vendor	pom	organization url	http://springsource.org/spring-framework	Medium
Vendor	pom	url	SpringSource/spring-framework	Highest
Product	file	name	spring-web	High
Product	hint analyzer	product	springsource_spring_framework	Highest
Product	jar	package name	springframework	Highest
Product	jar	package name	web	Highest
Product	Manifest	Implementation-Title	spring-web	High
Product	pom	artifactid	spring-web	Highest
Product	pom	developer email	jhoeller@gopivotal.com	Low
Product	pom	developer id	jhoeller	Low
Product	pom	developer name	Juergen Hoeller	Low
Product	pom	groupid	org.springframework	Highest
Product	pom	name	Spring Web	High
Product	pom	organization name	SpringSource	Low
Product	pom	organization url	http://springsource.org/spring-framework	Low
Product	pom	url	SpringSource/spring-framework	High
Version	Manifest	Implementation-Version	3.2.18.RELEASE	High
Version	pom	version	3.2.18.RELEASE	Highest

Identifiers

pkg:maven/org.springframework/spring-web@3.2.18.RELEASE (Confidence:High)
cpe:2.3:a:pivotal_software:spring_framework:3.2.18:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:springsource:spring_framework:3.2.18:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_framework:3.2.18:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:web_project:web:3.2.18:release:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

CVE-2016-1000027

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

CWE-502 Deserialization of Untrusted Data

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

OSSINDEX - [CVE-2016-1000027] CWE-502: Deserialization of Untrusted Data
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000027
OSSIndex - https://blog.gypsyengineer.com/en/security/detecting-dangerous-spring-exporters-with-codeql.html
OSSIndex - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027
OSSIndex - https://github.com/spring-projects/spring-framework/issues/24434
OSSIndex - https://www.tenable.com/security/research/tra-2016-20
cve@mitre.org - BROKEN_LINK,EXPLOIT,THIRD_PARTY_ADVISORY
cve@mitre.org - EXPLOIT,THIRD_PARTY_ADVISORY
cve@mitre.org - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
cve@mitre.org - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
cve@mitre.org - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
cve@mitre.org - ISSUE_TRACKING,THIRD_PARTY_ADVISORY
cve@mitre.org - RELEASE_NOTES,THIRD_PARTY_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* versions up to (excluding) 6.0.0

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

CWE-358 Improperly Implemented Security Check for Standard, CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CISA Known Exploited Vulnerability:

Product: VMware Spring Framework
Name: Spring Framework JDK 9+ Remote Code Execution Vulnerability
Date Added: 2022-04-04
Description: Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-25

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security@vmware.com - EXPLOIT,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@vmware.com - MITIGATION,VENDOR_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY,VDB_ENTRY

Vulnerable Software & Versions: (show all)

CVE-2024-22243 (OSSINDEX)

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.


Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2024-22243 for details

CWE-20 Improper Input Validation

CVSSv3:

Base Score: HIGH (8.100000381469727)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References:

OSSINDEX - [CVE-2024-22243] CWE-20: Improper Input Validation
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22243
OSSIndex - https://github.com/spring-projects/spring-framework/issues/32211
OSSIndex - https://spring.io/security/cve-2024-22243

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:org.springframework:spring-web:3.2.18.RELEASE:*:*:*:*:*:*:*

CVE-2024-22262 (OSSINDEX)

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

This is the same as  CVE-2024-22259 https://spring.io/security/cve-2024-22259  and  CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.

CWE-20 Improper Input Validation

CVSSv3:

Base Score: HIGH (8.100000381469727)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References:

OSSINDEX - [CVE-2024-22262] CWE-20: Improper Input Validation
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22262
OSSIndex - https://github.com/spring-projects/spring-framework/issues/32616
OSSIndex - https://spring.io/security/cve-2024-22262

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:org.springframework:spring-web:3.2.18.RELEASE:*:*:*:*:*:*:*

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - MITIGATION,VENDOR_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2018-1272 (OSSINDEX)

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

OSSINDEX - [CVE-2018-1272] CWE-264: Permissions, Privileges, and Access Controls
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1272
OSSIndex - https://access.redhat.com/security/cve/cve-2018-1272
OSSIndex - https://jira.spring.io/browse/SPR-16635
OSSIndex - https://pivotal.io/security/cve-2018-1272

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:org.springframework:spring-web:3.2.18.RELEASE:*:*:*:*:*:*:*

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (4.0)
Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

NVD-CWE-noinfo

CVSSv2:

Base Score: LOW (3.6)
Vector: /AV:N/AC:H/Au:S/C:P/I:P/A:N

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N/E:1.3/RC:R/MAV:A

References:

OSSINDEX - [CVE-2020-5421] CWE-noinfo
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-5421
OSSIndex - https://tanzu.vmware.com/security/cve-2020-5421
security@pivotal.io - NOT_APPLICABLE,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - THIRD_PARTY_ADVISORY
security@pivotal.io - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:

Base Score: MEDIUM (4.0)
Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

security@vmware.com - MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

NVD-CWE-noinfo

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:2.2/RC:R/MAV:A

References:

OSSINDEX - [CVE-2018-11039] CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11039
OSSIndex - https://jira.spring.io/browse/SPR-16836
OSSIndex - https://pivotal.io/security/cve-2018-11039
security_alert@emc.com - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - MITIGATION,VENDOR_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

CWE-178 Improper Handling of Case Sensitivity

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:

Base Score: LOW (3.5)
Vector: /AV:N/AC:M/Au:S/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:1.6/RC:R/MAV:A

References:

security@vmware.com - MITIGATION,VENDOR_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

Spring Web MVC

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: /home/jenkins/.m2/repository/org/springframework/spring-webmvc/3.2.18.RELEASE/spring-webmvc-3.2.18.RELEASE.jar
MD5: 2cb8a9569b95a76a0485d71c913c1819
SHA1: 60e5bb3dc9cb83d6cc53628082ec89a57d4832b2
SHA256:effcce98fd4e9fa95c9a53e49db801f1e2d011ee6dcbb7a7eb1a3ca3bcb2cfd5
Referenced In Projects/Scopes:

Gemma REST:compile
Gemma Web:compile

pkg:maven/gemma/gemma-rest@1.31.6
pkg:maven/gemma/gemma-web@1.31.6

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spring-webmvc	High
Vendor	hint analyzer	vendor	pivotal software	Highest
Vendor	hint analyzer	vendor	SpringSource	Highest
Vendor	hint analyzer	vendor	vmware	Highest
Vendor	jar	package name	mvc	Highest
Vendor	jar	package name	springframework	Highest
Vendor	jar	package name	web	Highest
Vendor	pom	artifactid	spring-webmvc	Highest
Vendor	pom	artifactid	spring-webmvc	Low
Vendor	pom	developer email	jhoeller@gopivotal.com	Low
Vendor	pom	developer id	jhoeller	Medium
Vendor	pom	developer name	Juergen Hoeller	Medium
Vendor	pom	groupid	org.springframework	Highest
Vendor	pom	name	Spring Web MVC	High
Vendor	pom	organization name	SpringSource	High
Vendor	pom	organization url	http://springsource.org/spring-framework	Medium
Vendor	pom	url	SpringSource/spring-framework	Highest
Product	file	name	spring-webmvc	High
Product	hint analyzer	product	springsource_spring_framework	Highest
Product	jar	package name	mvc	Highest
Product	jar	package name	springframework	Highest
Product	jar	package name	web	Highest
Product	Manifest	Implementation-Title	spring-webmvc	High
Product	pom	artifactid	spring-webmvc	Highest
Product	pom	developer email	jhoeller@gopivotal.com	Low
Product	pom	developer id	jhoeller	Low
Product	pom	developer name	Juergen Hoeller	Low
Product	pom	groupid	org.springframework	Highest
Product	pom	name	Spring Web MVC	High
Product	pom	organization name	SpringSource	Low
Product	pom	organization url	http://springsource.org/spring-framework	Low
Product	pom	url	SpringSource/spring-framework	High
Version	Manifest	Implementation-Version	3.2.18.RELEASE	High
Version	pom	version	3.2.18.RELEASE	Highest

Identifiers

pkg:maven/org.springframework/spring-webmvc@3.2.18.RELEASE (Confidence:High)
cpe:2.3:a:pivotal_software:spring_framework:3.2.18:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:springsource:spring_framework:3.2.18:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:vmware:spring_framework:3.2.18:release:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:web_project:web:3.2.18:release:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

CWE-358 Improperly Implemented Security Check for Standard, CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CISA Known Exploited Vulnerability:

Product: VMware Spring Framework
Name: Spring Framework JDK 9+ Remote Code Execution Vulnerability
Date Added: 2022-04-04
Description: Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
Required Action: Apply updates per vendor instructions.
Due Date: 2022-04-25

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

security@vmware.com - EXPLOIT,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@vmware.com - MITIGATION,VENDOR_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - PATCH,THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY,VDB_ENTRY

Vulnerable Software & Versions: (show all)

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A

References:

security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - MITIGATION,VENDOR_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (4.0)
Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY
security_alert@emc.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

NVD-CWE-noinfo

CVSSv2:

Base Score: LOW (3.6)
Vector: /AV:N/AC:H/Au:S/C:P/I:P/A:N

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N/E:1.3/RC:R/MAV:A

References:

OSSINDEX - [CVE-2020-5421] CWE-noinfo
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-5421
OSSIndex - https://tanzu.vmware.com/security/cve-2020-5421
security@pivotal.io - NOT_APPLICABLE,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - PATCH,THIRD_PARTY_ADVISORY
security@pivotal.io - THIRD_PARTY_ADVISORY
security@pivotal.io - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:

Base Score: MEDIUM (4.0)
Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

security@vmware.com - MITIGATION,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

NVD-CWE-noinfo

CVSSv3:

Base Score: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:2.8/RC:R/MAV:A

References:

security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2018-1271 (OSSINDEX)

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:

Base Score: MEDIUM (5.900000095367432)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions (OSSINDEX):

cpe:2.3:a:org.springframework:spring-webmvc:3.2.18.RELEASE:*:*:*:*:*:*:*

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSSv3:

Base Score: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:2.2/RC:R/MAV:A

References:

OSSINDEX - [CVE-2018-11039] CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11039
OSSIndex - https://jira.spring.io/browse/SPR-16836
OSSIndex - https://pivotal.io/security/cve-2018-11039
security_alert@emc.com - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security_alert@emc.com - MAILING_LIST,THIRD_PARTY_ADVISORY
security_alert@emc.com - MITIGATION,VENDOR_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY
security_alert@emc.com - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

CWE-178 Improper Handling of Case Sensitivity

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

Base Score: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - THIRD_PARTY_ADVISORY
security@vmware.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)