CVEvulnerability

CVE-2022-22968

5.3 MEDIUM Published 2022-04-14 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2022-04-14
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-178

Description

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

Affected configurations

• vmware spring framework (< 5.2.0) • vmware spring framework (>= 5.2.0 <= 5.2.20) • vmware spring framework (>= 5.3.0 <= 5.3.18) • netapp active iq unified manager • netapp cloud secure agent • netapp metrocluster tiebreaker • netapp snap creator framework • netapp snapmanager • oracle mysql enterprise monitor (<= 8.0.29)

Related

Weakness · CWE (1)

  • CWE-178 Improper Handling of Case Sensitivity weakness

References