PT-2022-15748 · Unknown+1 · Spring Framework+1

Ahmed Alwardani · Published 2022-04-14 · Updated 2024-10-22 · CVE-2022-22968

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spring Framework versions 5.3.0 through 5.3.18 Spring Framework versions 5.2.0 through 5.2.20 Spring Framework older unsupported versions

Description The patterns for disallowedFields on a DataBinder in Spring Framework are case sensitive. This means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

Recommendations For Spring Framework versions 5.3.0 through 5.3.18, update to version 5.3.19 or later. For Spring Framework versions 5.2.0 through 5.2.20, update to version 5.2.21 or later. For Spring Framework older unsupported versions, there is no information about a newer version that contains a fix for this issue.

Fix

Weakness Enumeration

CWE-178

Related Identifiers

CVE-2022-22968

GHSA-G5MM-VMX4-3RG7

Affected Products

Debian

Spring Framework

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2022-22968 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-22968 · Vendor Advisory
• https://tanzu.vmware.com/security/cve-2022-22968 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-22968 · Security Note
• https://osv.dev/vulnerability/GHSA-g5mm-vmx4-3rg7 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-22968 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-22968 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22968 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-22968 · Vendor Advisory
• https://github.com/spring-projects/spring-framework · Note
• https://github.com/spring-projects/spring-framework/commit/a7cf19cec5ebd270f97a194d749e2d5701ad2ab7 · Note
• https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea · Note
• https://t.me/cibsecurity/40833 · Telegram Post
• https://oracle.com/security-alerts/cpujul2022.html · Note
• https://t.me/cvenotify/99093 · Telegram Post