Skip to content
OpenAdvisories

Package · Maven

org.springframework:spring

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2023-20860 Public exploit

    Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

    Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a securit…

    libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring Debian Ubuntu Maven
  • Medium —
    CVE-2010-1622 Public exploit EPSS 52%

    Improper Control of Generation of Code ('Code Injection') in Spring Framework

    SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

    org.springframework:spring Maven