PT-2024-2177 · Unknown+2 · Spring Framework+4

Threedr3Am · Published 2024-03-14 · Updated 2026-04-24 · CVE-2024-22259

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Spring Framework versions prior to 6.1.5 Spring Framework versions prior to 6.0.18 Spring Framework versions prior to 5.3.33

Description The issue exists due to insufficient validation of user-input data in the UriComponentsBuilder component of the Spring Framework. This can allow a remote attacker to perform a Server-Side Request Forgery (SSRF) attack. The vulnerability poses risks to systems, potentially exposing them to open redirect and SSRF attacks. Approximately 1,139,824 results are mainly distributed in China, the United States, and other countries.

Recommendations For Spring Framework versions prior to 6.1.5, update to version 6.1.5 or later. For Spring Framework versions prior to 6.0.18, update to version 6.0.18 or later. For Spring Framework versions prior to 5.3.33, update to version 5.3.33 or later. As a temporary workaround, consider restricting the use of the UriComponentsBuilder component until a patch is applied. Avoid using the host variable in the affected API endpoint until the issue is resolved.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2024-02091

CVE-2024-22259

GHSA-HGJH-9RJ2-G67J

Affected Products

Bamboo

Bitbucket

Confluence

Debian

Spring Framework

References · 36

• https://spring.io/security/cve-2024-22259 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-22259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22259 · Security Note
• https://bdu.fstec.ru/vul/2024-02091 · Security Note
• https://osv.dev/vulnerability/GHSA-hgjh-9rj2-g67j · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-22259 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22259 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-22259 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-22259 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-22259 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22259 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2024-22259 · Vendor Advisory
• https://github.com/spring-projects/spring-framework · Note
• https://github.com/spring-projects/spring-framework/commit/381f790329a48b74c2a49fc1384dd68ca9153501 · Note
• https://github.com/spring-projects/spring-framework/commit/f2fd2f12269c6a781c5b2c20b3c24141055a3d68 · Note