GitHub Advisoryadvisory · Maven

GHSA-2r2v-q399-qq93 Request injection in Spring Cloud Gateway

MEDIUM Published 2021-11-10 Modified 2021-11-10 Official page ↗
Aliases
CVE-2021-22051
Ecosystem
Maven
Packages
org.springframework.cloud:spring-cloud-gateway
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-352, CWE-863
Reviewed
2021-11-09

Affected packages

• Maven org.springframework.cloud:spring-cloud-gateway: >= 3.0.0, < 3.0.5 → fixed in 3.0.5 • Maven org.springframework.cloud:spring-cloud-gateway: >= 2.2.0, < 2.2.10.RELEASE0.5 → fixed in 2.2.10.RELEASE0.5

Description

Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.

Related

Alias · CVE (1)

  • CVE-2021-22051 Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream… vulnerability

Weakness · CWE (2)

  • CWE-352 Cross-Site Request Forgery weakness
  • CWE-863 Incorrect Authorization weakness

References