Non notée
CVE-2022-22968 In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for…
Description
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Framework | Versions non publiées |
Références
- tanzu.vmware.com tanzu.vmware.com
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Spring Framework
Les 13 CVE de Spring Framework →
CVE-2024-38819
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to…
7.5
Élevée
CVE-2024-38809
Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack
5.3
Moyenne
CVE-2023-20863
In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a…
6.5
Moyenne
CVE-2023-20860
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security…
7.5
Élevée