org.springframework:spring

3 results · Feed

• High 7.5
  CVE-2023-20860 Public exploit

  Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

  Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a securit…

  libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring Debian Ubuntu Maven
  Mar 27, 2023
• Medium 4.3
  CVE-2021-22096

  Improper Output Neutralization for Logs in Spring Framework

  In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

  libspring-java libspring-java org.springframework:spring-core org.springframework:spring Debian Ubuntu Maven
  Oct 28, 2021
• Medium —
  CVE-2010-1622 Public exploit EPSS 52%

  Improper Control of Generation of Code ('Code Injection') in Spring Framework

  SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

  org.springframework:spring Maven
  Jun 21, 2010