René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"spring-webmvc-4.3.30.RELEASE.jar: 2 vulnerabilities (highest severity is: 5.3) [master] (unreachable)","articleBody":"\u003cdetails\u003e\n  \u003csummary\u003e📂 Vulnerable Library - \u003cstrong\u003espring-webmvc-4.3.30.RELEASE.jar\u003c/strong\u003e\u003c/summary\u003e\n\nSpring Web MVC\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-webmvc/4.3.30.RELEASE/spring-webmvc-4.3.30.RELEASE.jar\n\n\n\u003c/details\u003e\n\n\n# Findings\n| Finding | Severity | 🎯 CVSS | Exploit Maturity | EPSS | Library | Type | Fixed in | Remediation Available | **Reachability** |\n| ------------- | ------------- | ---- | --- | ----- | ----- | ----- | --- | --- | --- |\n| [ CVE-2021-22096 ](https://www.mend.io/vulnerability-database/CVE-2021-22096) | 🟠 Medium | 5.3 | Not Defined | \u003c 1% | spring-webmvc-4.3.30.RELEASE.jar | Direct | N/A | ❌ |\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=20 height=22\u003e Unreachable |\n| [ CVE-2024-38820 ](https://www.mend.io/vulnerability-database/CVE-2024-38820) | 🟡 Low | 2.3 | Not Defined | \u003c 1% | spring-webmvc-4.3.30.RELEASE.jar | Direct | org.springframework:spring-context:6.1.14 | ✅ | |\n\n\n# Details\n\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟠CVE-2021-22096\n  \u003c/summary\u003e\n\n### Vulnerable Library - **spring-webmvc-4.3.30.RELEASE.jar**\n\nSpring Web MVC\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-webmvc/4.3.30.RELEASE/spring-webmvc-4.3.30.RELEASE.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- ❌  **spring-webmvc-4.3.30.RELEASE.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Reachability Analysis\nThe vulnerable code is unreachable\n***\n\n### Vulnerability Details\n\nIn Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.\n\n**Publish Date:** Oct 28, 2021 03:22 PM\n\n**URL:** [ CVE-2021-22096 ](https://www.mend.io/vulnerability-database/CVE-2021-22096)\n\n**Threat Assessment**\n\nExploit Maturity:Not Defined\n\nEPSS:\u003c 1%\n\n**Score:** 5.3\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** \n\n**Release Date:** \n\n**Fix Resolution :** \n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟡CVE-2024-38820\n  \u003c/summary\u003e\n\n### Vulnerable Library - **spring-webmvc-4.3.30.RELEASE.jar**\n\nSpring Web MVC\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-webmvc/4.3.30.RELEASE/spring-webmvc-4.3.30.RELEASE.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- ❌  **spring-webmvc-4.3.30.RELEASE.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Vulnerability Details\n\nThe fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.\n\n**Publish Date:** Oct 18, 2024 05:39 AM\n\n**URL:** [ CVE-2024-38820 ](https://www.mend.io/vulnerability-database/CVE-2024-38820)\n\n**Threat Assessment**\n\nExploit Maturity:Not Defined\n\nEPSS:\u003c 1%\n\n**Score:** 2.3\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://github.com/advisories/GHSA-4gc7-5j7h-4qph\n\n**Release Date:** Oct 18, 2024 05:39 AM\n\n**Fix Resolution :** org.springframework:spring-context:6.1.14\n\n\n\u003c/details\u003e\n\n[comment]: \u003c\u003e (\u003cMEND_ISSUE_METADATA\u003e{\"identifier\":\"spring-webmvc-4.3.30.RELEASE.jar\",\"repoName\":\"BenchmarkJava\",\"branchName\":\"master\",\"type\":\"SCA_DEP\"}\u003c/MEND_ISSUE_METADATA\u003e)","author":{"url":"https://github.com/mend-developer-platform-dev[bot]","@type":"Person","name":"mend-developer-platform-dev[bot]"},"datePublished":"2025-09-28T05:43:40.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/36/BenchmarkJava/issues/36"}