René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"spring-context-4.3.30.RELEASE.jar: 12 vulnerabilities (highest severity is: 9.3) [master] (reachable)","articleBody":"\u003cdetails\u003e\n  \u003csummary\u003e📂 Vulnerable Library - \u003cstrong\u003espring-context-4.3.30.RELEASE.jar\u003c/strong\u003e\u003c/summary\u003e\n\nSpring Context\n\n\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-context/4.3.30.RELEASE/spring-context-4.3.30.RELEASE.jar\n\n\n\u003c/details\u003e\n\n\n# Findings\n| Finding | Severity | 🎯 CVSS | Exploit Maturity | EPSS | Library | Type | Fixed in | Remediation Available | **Reachability** |\n| ------------- | ------------- | ---- | --- | ----- | ----- | ----- | --- | --- | --- |\n| [ CVE-2022-22965 ](https://www.mend.io/vulnerability-database/CVE-2022-22965) | 🟣 Critical | 9.3 | High | 94.4% | spring-beans-4.3.30.RELEASE.jar | Transitive | N/A | ❌ |\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=20 height=22\u003e Unreachable |\n| [ CVE-2018-1271 ](https://www.mend.io/vulnerability-database/CVE-2018-1271) | 🔴 High | 8.2 | Not Defined | 91.2% | spring-core-4.3.30.RELEASE.jar | Transitive | N/A | ❌ | |\n| [ CVE-2018-1257 ](https://www.mend.io/vulnerability-database/CVE-2018-1257) | 🔴 High | 7.1 | Not Defined | 1.8% | spring-core-4.3.30.RELEASE.jar | Transitive | N/A | ❌ | |\n| [ CVE-2022-22950 ](https://www.mend.io/vulnerability-database/CVE-2022-22950) | 🔴 High | 7.1 | Not Defined | 4.1% | spring-expression-4.3.30.RELEASE.jar | Transitive | N/A | ❌ |\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=20 height=22\u003e Unreachable |\n| [ CVE-2023-20861 ](https://www.mend.io/vulnerability-database/CVE-2023-20861) | 🔴 High | 7.1 | Not Defined | \u003c 1% | spring-expression-4.3.30.RELEASE.jar | Transitive | N/A | ❌ |\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=20 height=22\u003e Unreachable |\n| [ CVE-2023-20863 ](https://www.mend.io/vulnerability-database/CVE-2023-20863) | 🔴 High | 7.1 | Not Defined | \u003c 1% | spring-expression-4.3.30.RELEASE.jar | Transitive | N/A | ❌ |\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=20 height=22\u003e Unreachable |\n| [ CVE-2022-22968 ](https://www.mend.io/vulnerability-database/CVE-2022-22968) | 🟠 Medium | 6.9 | Not Defined | 16.2% | spring-context-4.3.30.RELEASE.jar | Direct | org.springframework:spring-context:5.2.21.RELEASE,org.springframework:spring-context:5.3.19 | ✅ |\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=20 height=22\u003e Unreachable |\n| [ CVE-2022-22970 ](https://www.mend.io/vulnerability-database/CVE-2022-22970) | 🟠 Medium | 6.0 | Not Defined | \u003c 1% | spring-core-4.3.30.RELEASE.jar | Transitive | N/A | ❌ |\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=20 height=22\u003e Unreachable |\n| [ CVE-2022-22970 ](https://www.mend.io/vulnerability-database/CVE-2022-22970) | 🟠 Medium | 6.0 | Not Defined | \u003c 1% | spring-beans-4.3.30.RELEASE.jar | Transitive | N/A | ❌ |\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=20 height=22\u003e Unreachable |\n| [ CVE-2021-22060 ](https://www.mend.io/vulnerability-database/CVE-2021-22060) | 🟠 Medium | 5.3 | Not Defined | \u003c 1% | spring-core-4.3.30.RELEASE.jar | Transitive | N/A | ❌ |\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=20 height=22\u003e Reachable |\n| [ CVE-2021-22096 ](https://www.mend.io/vulnerability-database/CVE-2021-22096) | 🟠 Medium | 5.3 | Not Defined | \u003c 1% | spring-core-4.3.30.RELEASE.jar | Transitive | N/A | ❌ |\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=20 height=22\u003e Reachable |\n| [ CVE-2024-38820 ](https://www.mend.io/vulnerability-database/CVE-2024-38820) | 🟡 Low | 2.3 | Not Defined | \u003c 1% | spring-core-4.3.30.RELEASE.jar | Transitive | N/A | ❌ | |\n\n\n# Details\n\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟣CVE-2022-22965\n  \u003c/summary\u003e\n\n### Vulnerable Library - **spring-beans-4.3.30.RELEASE.jar**\n\nSpring Beans\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-beans/4.3.30.RELEASE/spring-beans-4.3.30.RELEASE.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- spring-context-4.3.30.RELEASE.jar (Root Library)\n    - spring-aop-4.3.30.RELEASE.jar\n        - ❌  **spring-beans-4.3.30.RELEASE.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Reachability Analysis\nThe vulnerable code is unreachable\n***\n\n### Vulnerability Details\n\nA Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. Converted from WS-2022-0107, on 2022-11-07.\n\n**Publish Date:** Apr 01, 2022 10:17 PM\n\n**URL:** [ CVE-2022-22965 ](https://www.mend.io/vulnerability-database/CVE-2022-22965)\n\n**Threat Assessment**\n\nExploit Maturity:High\n\nEPSS:94.4%\n\n**Score:** 9.3\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://github.com/advisories/GHSA-36p3-wjmg-h94x\n\n**Release Date:** Apr 01, 2022 10:17 PM\n\n**Fix Resolution :** org.springframework:spring-webflux:5.2.20.RELEASE,org.springframework:spring-webflux:5.3.18,org.springframework:spring-webmvc:5.3.18,org.springframework:spring-webmvc:5.2.20.RELEASE,org.springframework:spring-beans:5.2.20.RELEASE,org.springframework.boot:spring-boot-starter-webflux:2.5.12,org.springframework.boot:spring-boot-starter-webflux:2.6.6,org.springframework:spring-beans:5.3.18,org.springframework.boot:spring-boot-starter-web:2.5.12,org.springframework.boot:spring-boot-starter-web:2.6.6\n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🔴CVE-2018-1271\n  \u003c/summary\u003e\n\n### Vulnerable Library - **spring-core-4.3.30.RELEASE.jar**\n\nSpring Core\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-core/4.3.30.RELEASE/spring-core-4.3.30.RELEASE.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- spring-context-4.3.30.RELEASE.jar (Root Library)\n    - spring-aop-4.3.30.RELEASE.jar\n        - spring-beans-4.3.30.RELEASE.jar\n            - ❌  **spring-core-4.3.30.RELEASE.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Vulnerability Details\n\nSpring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.\n\n**Publish Date:** Apr 06, 2018 01:00 PM\n\n**URL:** [ CVE-2018-1271 ](https://www.mend.io/vulnerability-database/CVE-2018-1271)\n\n**Threat Assessment**\n\nExploit Maturity:Not Defined\n\nEPSS:91.2%\n\n**Score:** 8.2\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1271\n\n**Release Date:** Apr 06, 2018 01:00 PM\n\n**Fix Resolution :** org.springframework:spring-webflux:5.0.5.RELEASE,org.springframework:spring-webmvc:4.3.15.RELEASE,5.0.5.RELEASE\n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🔴CVE-2018-1257\n  \u003c/summary\u003e\n\n### Vulnerable Library - **spring-core-4.3.30.RELEASE.jar**\n\nSpring Core\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-core/4.3.30.RELEASE/spring-core-4.3.30.RELEASE.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- spring-context-4.3.30.RELEASE.jar (Root Library)\n    - spring-aop-4.3.30.RELEASE.jar\n        - spring-beans-4.3.30.RELEASE.jar\n            - ❌  **spring-core-4.3.30.RELEASE.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Vulnerability Details\n\nSpring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.\n\n**Publish Date:** May 11, 2018 08:00 PM\n\n**URL:** [ CVE-2018-1257 ](https://www.mend.io/vulnerability-database/CVE-2018-1257)\n\n**Threat Assessment**\n\nExploit Maturity:Not Defined\n\nEPSS:1.8%\n\n**Score:** 7.1\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://nvd.nist.gov/vuln/detail/CVE-2018-1257\n\n**Release Date:** May 11, 2018 08:00 PM\n\n**Fix Resolution :** 5.0.6,4.3.17\n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🔴CVE-2022-22950\n  \u003c/summary\u003e\n\n### Vulnerable Library - **spring-expression-4.3.30.RELEASE.jar**\n\nSpring Expression Language (SpEL)\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-expression/4.3.30.RELEASE/spring-expression-4.3.30.RELEASE.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- spring-context-4.3.30.RELEASE.jar (Root Library)\n    - ❌  **spring-expression-4.3.30.RELEASE.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Reachability Analysis\nThe vulnerable code is unreachable\n***\n\n### Vulnerability Details\n\nn Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.\n\n**Publish Date:** Apr 01, 2022 10:17 PM\n\n**URL:** [ CVE-2022-22950 ](https://www.mend.io/vulnerability-database/CVE-2022-22950)\n\n**Threat Assessment**\n\nExploit Maturity:Not Defined\n\nEPSS:4.1%\n\n**Score:** 7.1\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://github.com/advisories/GHSA-558x-2xjg-6232\n\n**Release Date:** Apr 01, 2022 10:17 PM\n\n**Fix Resolution :** org.springframework:spring-expression:5.2.20.RELEASE,org.springframework:spring-expression:5.3.17\n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🔴CVE-2023-20861\n  \u003c/summary\u003e\n\n### Vulnerable Library - **spring-expression-4.3.30.RELEASE.jar**\n\nSpring Expression Language (SpEL)\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-expression/4.3.30.RELEASE/spring-expression-4.3.30.RELEASE.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- spring-context-4.3.30.RELEASE.jar (Root Library)\n    - ❌  **spring-expression-4.3.30.RELEASE.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Reachability Analysis\nThe vulnerable code is unreachable\n***\n\n### Vulnerability Details\n\nIn Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.\n\n**Publish Date:** Mar 23, 2023 12:00 AM\n\n**URL:** [ CVE-2023-20861 ](https://www.mend.io/vulnerability-database/CVE-2023-20861)\n\n**Threat Assessment**\n\nExploit Maturity:Not Defined\n\nEPSS:\u003c 1%\n\n**Score:** 7.1\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://github.com/advisories/GHSA-564r-hj7v-mcr5\n\n**Release Date:** Mar 23, 2023 12:00 AM\n\n**Fix Resolution :** org.springframework:spring-expression:5.3.26,org.springframework:spring-expression:6.0.7,org.springframework:spring-expression:5.2.23.RELEASE\n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🔴CVE-2023-20863\n  \u003c/summary\u003e\n\n### Vulnerable Library - **spring-expression-4.3.30.RELEASE.jar**\n\nSpring Expression Language (SpEL)\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-expression/4.3.30.RELEASE/spring-expression-4.3.30.RELEASE.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- spring-context-4.3.30.RELEASE.jar (Root Library)\n    - ❌  **spring-expression-4.3.30.RELEASE.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Reachability Analysis\nThe vulnerable code is unreachable\n***\n\n### Vulnerability Details\n\nIn spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.\n\n**Publish Date:** Apr 13, 2023 12:00 AM\n\n**URL:** [ CVE-2023-20863 ](https://www.mend.io/vulnerability-database/CVE-2023-20863)\n\n**Threat Assessment**\n\nExploit Maturity:Not Defined\n\nEPSS:\u003c 1%\n\n**Score:** 7.1\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://github.com/advisories/GHSA-wxqc-pxw9-g2p8\n\n**Release Date:** Apr 13, 2023 12:00 AM\n\n**Fix Resolution :** org.springframework:spring-expression:5.3.27,org.springframework:spring-expression:5.2.24.RELEASE,org.springframework:spring-expression:6.0.8\n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟠CVE-2022-22968\n  \u003c/summary\u003e\n\n### Vulnerable Library - **spring-context-4.3.30.RELEASE.jar**\n\nSpring Context\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-context/4.3.30.RELEASE/spring-context-4.3.30.RELEASE.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- ❌  **spring-context-4.3.30.RELEASE.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Reachability Analysis\nThe vulnerable code is unreachable\n***\n\n### Vulnerability Details\n\nIn Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.\n\n**Publish Date:** Apr 14, 2022 08:05 PM\n\n**URL:** [ CVE-2022-22968 ](https://www.mend.io/vulnerability-database/CVE-2022-22968)\n\n**Threat Assessment**\n\nExploit Maturity:Not Defined\n\nEPSS:16.2%\n\n**Score:** 6.9\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://github.com/advisories/GHSA-g5mm-vmx4-3rg7\n\n**Release Date:** Apr 14, 2022 08:05 PM\n\n**Fix Resolution :** org.springframework:spring-context:5.2.21.RELEASE,org.springframework:spring-context:5.3.19\n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟠CVE-2022-22970\n  \u003c/summary\u003e\n\n### Vulnerable Library - **spring-core-4.3.30.RELEASE.jar**\n\nSpring Core\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-core/4.3.30.RELEASE/spring-core-4.3.30.RELEASE.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- spring-context-4.3.30.RELEASE.jar (Root Library)\n    - spring-aop-4.3.30.RELEASE.jar\n        - spring-beans-4.3.30.RELEASE.jar\n            - ❌  **spring-core-4.3.30.RELEASE.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Reachability Analysis\nThe vulnerable code is unreachable\n***\n\n### Vulnerability Details\n\nIn spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.\n\n**Publish Date:** May 12, 2022 07:28 PM\n\n**URL:** [ CVE-2022-22970 ](https://www.mend.io/vulnerability-database/CVE-2022-22970)\n\n**Threat Assessment**\n\nExploit Maturity:Not Defined\n\nEPSS:\u003c 1%\n\n**Score:** 6.0\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://github.com/advisories/GHSA-hh26-6xwr-ggv7\n\n**Release Date:** May 12, 2022 07:28 PM\n\n**Fix Resolution :** org.springframework:spring-beans:5.2.22.RELEASE,org.springframework:spring-beans:5.3.20\n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟠CVE-2022-22970\n  \u003c/summary\u003e\n\n### Vulnerable Library - **spring-beans-4.3.30.RELEASE.jar**\n\nSpring Beans\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-beans/4.3.30.RELEASE/spring-beans-4.3.30.RELEASE.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- spring-context-4.3.30.RELEASE.jar (Root Library)\n    - spring-aop-4.3.30.RELEASE.jar\n        - ❌  **spring-beans-4.3.30.RELEASE.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Reachability Analysis\nThe vulnerable code is unreachable\n***\n\n### Vulnerability Details\n\nIn spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.\n\n**Publish Date:** May 12, 2022 07:28 PM\n\n**URL:** [ CVE-2022-22970 ](https://www.mend.io/vulnerability-database/CVE-2022-22970)\n\n**Threat Assessment**\n\nExploit Maturity:Not Defined\n\nEPSS:\u003c 1%\n\n**Score:** 6.0\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://github.com/advisories/GHSA-hh26-6xwr-ggv7\n\n**Release Date:** May 12, 2022 07:28 PM\n\n**Fix Resolution :** org.springframework:spring-beans:5.2.22.RELEASE,org.springframework:spring-beans:5.3.20\n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟠CVE-2021-22060\n  \u003c/summary\u003e\n\n### Vulnerable Library - **spring-core-4.3.30.RELEASE.jar**\n\nSpring Core\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-core/4.3.30.RELEASE/spring-core-4.3.30.RELEASE.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- spring-context-4.3.30.RELEASE.jar (Root Library)\n    - spring-aop-4.3.30.RELEASE.jar\n        - spring-beans-4.3.30.RELEASE.jar\n            - ❌  **spring-core-4.3.30.RELEASE.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Reachability Analysis\nThis vulnerability is potentially reachable:\n\n```\n- org.owasp.benchmark.helpers.DataBaseServer (Application)\n    - org.springframework.http.ResponseEntity (Extension)\n        - org.springframework.http.HttpHeaders (Extension)\n            - org.springframework.http.HttpRange (Extension)\n                - org.springframework.core.io.InputStreamResource (Extension)\n                    - org.springframework.core.io.AbstractResource (Extension)\n                        - org.springframework.util.ResourceUtils (Extension)\n                            - org.springframework.util.ClassUtils (Extension)\n                                - org.springframework.util.ReflectionUtils (Extension)\n                                    - org.springframework.util.ConcurrentReferenceHashMap (Extension)\n                                        -\u003e ❌ org.springframework.util.ConcurrentReferenceHashMap$Task (Vulnerable Component)\n```\n***\n\n### Vulnerability Details\n\nIn Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.\n\n**Publish Date:** Jan 07, 2022 10:39 PM\n\n**URL:** [ CVE-2021-22060 ](https://www.mend.io/vulnerability-database/CVE-2021-22060)\n\n**Threat Assessment**\n\nExploit Maturity:Not Defined\n\nEPSS:\u003c 1%\n\n**Score:** 5.3\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://github.com/advisories/GHSA-6gf2-pvqw-37ph\n\n**Release Date:** Jan 07, 2022 10:39 PM\n\n**Fix Resolution :** org.springframework:spring-core:5.3.14\n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟠CVE-2021-22096\n  \u003c/summary\u003e\n\n### Vulnerable Library - **spring-core-4.3.30.RELEASE.jar**\n\nSpring Core\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-core/4.3.30.RELEASE/spring-core-4.3.30.RELEASE.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- spring-context-4.3.30.RELEASE.jar (Root Library)\n    - spring-aop-4.3.30.RELEASE.jar\n        - spring-beans-4.3.30.RELEASE.jar\n            - ❌  **spring-core-4.3.30.RELEASE.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Reachability Analysis\nThis vulnerability is potentially reachable:\n\n```\n- org.owasp.benchmark.helpers.DataBaseServer (Application)\n    - org.springframework.http.ResponseEntity (Extension)\n        - org.springframework.http.ResponseEntity$BodyBuilder (Extension)\n            - org.springframework.http.MediaType (Extension)\n                -\u003e ❌ org.springframework.util.MimeType (Vulnerable Component)\n```\n***\n\n### Vulnerability Details\n\nIn Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.\n\n**Publish Date:** Oct 28, 2021 03:22 PM\n\n**URL:** [ CVE-2021-22096 ](https://www.mend.io/vulnerability-database/CVE-2021-22096)\n\n**Threat Assessment**\n\nExploit Maturity:Not Defined\n\nEPSS:\u003c 1%\n\n**Score:** 5.3\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** \n\n**Release Date:** \n\n**Fix Resolution :** \n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟡CVE-2024-38820\n  \u003c/summary\u003e\n\n### Vulnerable Library - **spring-core-4.3.30.RELEASE.jar**\n\nSpring Core\n\n**Library home page:** [ https://projects.spring.io/spring-framework ](https://projects.spring.io/spring-framework)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/org/springframework/spring-core/4.3.30.RELEASE/spring-core-4.3.30.RELEASE.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- spring-context-4.3.30.RELEASE.jar (Root Library)\n    - spring-aop-4.3.30.RELEASE.jar\n        - spring-beans-4.3.30.RELEASE.jar\n            - ❌  **spring-core-4.3.30.RELEASE.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Vulnerability Details\n\nThe fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.\n\n**Publish Date:** Oct 18, 2024 05:39 AM\n\n**URL:** [ CVE-2024-38820 ](https://www.mend.io/vulnerability-database/CVE-2024-38820)\n\n**Threat Assessment**\n\nExploit Maturity:Not Defined\n\nEPSS:\u003c 1%\n\n**Score:** 2.3\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** https://github.com/advisories/GHSA-4gc7-5j7h-4qph\n\n**Release Date:** Oct 18, 2024 05:39 AM\n\n**Fix Resolution :** org.springframework:spring-context:6.1.14\n\n\n\u003c/details\u003e\n\n[comment]: \u003c\u003e (\u003cMEND_ISSUE_METADATA\u003e{\"identifier\":\"spring-context-4.3.30.RELEASE.jar\",\"repoName\":\"BenchmarkJava\",\"branchName\":\"master\",\"type\":\"SCA_DEP\"}\u003c/MEND_ISSUE_METADATA\u003e)","author":{"url":"https://github.com/mend-developer-platform-dev[bot]","@type":"Person","name":"mend-developer-platform-dev[bot]"},"datePublished":"2025-09-28T05:43:41.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/38/BenchmarkJava/issues/38"}