Skip to content
fr Sign in
Not rated

CVE-2022-22968 In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for…

Description

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

Affected products and versions

Product Affected versions Fixed in
Spring Framework Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring Framework

The 13 CVEs of Spring Framework →
CVE-2024-38819 Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to… 7.5 High CVE-2024-38809 Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack 5.3 Medium CVE-2023-20863 In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a… 6.5 Medium CVE-2023-20860 Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security… 7.5 High
Track this CVE