8.1
Élevée
CVE-2024-22259 Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g
Description
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Framework | Versions non publiées | |
| spring_framework 6.1 | 6.1.0 → < 6.1.5 | 6.1.5 |
| spring_framework 6.0 | 6.0.0 → < 6.0.18 | 6.0.18 |
| spring_framework 5.3 | 5.3.0 → < 5.3.33 | 5.3.33 |
Références
- spring.io spring.io
- security.netapp.com security.netapp.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Spring Framework
Les 45 CVE de Spring Framework →
CVE-2026-59314
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response…
3.7
Faible
CVE-2026-59313
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent…
9.8
Critique
CVE-2026-59283
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable…
9.1
Critique
CVE-2026-59282
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a…
7.5
Élevée