Spring Framework
13 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-38819 | Spring Framework 5.3.0 - 5.3.40, 6.0.0 - 6.0.24, 6.1.0 - 6.1.13 | Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks | HIGH 7.5 | 56 % | ||
| CVE-2024-38809 | 6.1.0 - 6.1.11, 6.0.0 - 6.0.22, 5.3.0 - 5.3.37 | Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions s | MEDIUM 5.3 | 0.9 % | ||
| CVE-2023-20863 | Spring framework versions 5.2.x.release prior to 5.2.24.release+, 5.3.x prior to 5.3.27+, 6.0.x prior to 6.0.8+ and older unsupported versions | In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL ex | MEDIUM 6.5 | 1.1 % | ||
| CVE-2023-20860 | Spring Framework (versions 6.0.0 to 6.0.6 and 5.3.0 to 5.3.25) | Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcReques | HIGH 7.5 | 3.5 % | ||
| CVE-2023-20861 | Spring Framework (6.0.0 to 6.0.6, 5.3.0 to 5.3.25, 5.2.0.RELEASE to 5.2.22.RELEASE, Older unsupported versions are also affected) | In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible f | MEDIUM 6.5 | 1.0 % | ||
| CVE-2022-22971 | Spring Framework versions 5.3.x prior to 5.3.20, 5.2.x prior to 5.2.22 and all old and unsupported versions | In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vu | MEDIUM 6.5 | 3.2 % | ||
| CVE-2022-22970 | Spring Framework versions 5.3.x prior to 5.3.20, 5.2.x prior to 5.2.22 and all old and unsupported versions | In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable t | MEDIUM 5.3 | 2.0 % | ||
| CVE-2022-22968 | Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions | In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBind | MEDIUM 5.3 | 5.7 % | ||
| CVE-2022-22950 | Spring Framework versions 5.3.X prior to 5.3.17+ and all old and unsupported versions | n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL exp | MEDIUM 6.5 | 36 % | ||
| CVE-2022-22965 | Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2021-22060 | Spring Framework 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions | In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious | MEDIUM 4.3 | 0.8 % | ||
| CVE-2021-22096 | Spring Framework versions 5.3.x prior to 5.3.12+, 5.2.x prior to 5.2.18+ and all older unsupported versions are impacted. | In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious | MEDIUM 4.3 | 1.4 % | ||
| CVE-2021-22118 | Spring Framework versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7 | In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege es | HIGH 7.8 | 0.4 % |