PT-2024-2941 · Unknown+2 · Spring Framework+4

L0Ne1Y · Published 2024-04-11 · Updated 2025-02-20 · CVE-2024-22262

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Spring Framework versions prior to 5.3.34 Spring Framework versions prior to 6.0.19 Spring Framework versions prior to 6.1.6

Description The issue exists due to insufficient validation of user-input data in the UriComponentsBuilder component of the Spring Framework. This can allow a remote attacker to perform a Server-Side Request Forgery (SSRF) attack. Applications that use UriComponentsBuilder to parse externally provided URLs and perform validation checks on the host are affected.

Recommendations For Spring Framework versions prior to 5.3.34, update to version 5.3.34 or later. For Spring Framework versions prior to 6.0.19, update to version 6.0.19 or later. For Spring Framework versions prior to 6.1.6, update to version 6.1.6 or later.

Fix

SSRF

Open Redirect

Weakness Enumeration

CWE-918

CWE-601

Related Identifiers

BDU:2024-03108

CVE-2024-22262

GHSA-2WRP-6FG6-HMC5

Affected Products

Bamboo

Bitbucket

Confluence

Debian

Spring Framework

References · 28

• https://nvd.nist.gov/vuln/detail/CVE-2024-22262 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22262 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-22262 · Security Note
• https://bdu.fstec.ru/vul/2024-03108 · Security Note
• https://ubuntu.com/security/CVE-2024-22262 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22262 · Security Note
• https://osv.dev/vulnerability/GHSA-2wrp-6fg6-hmc5 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-22262 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-22262 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-22262 · Vendor Advisory
• https://github.com/spring-projects/spring-framework · Note
• https://github.com/spring-projects/spring-framework/blob/main/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java · Note
• https://twitter.com/herodevs/status/1892659901958144162 · Twitter Post
• https://twitter.com/snicoll/status/1778383445103632678 · Twitter Post
• https://security.netapp.com/advisory/ntap-20240524-0003 · Note