GitHub Advisoryadvisory · Maven

GHSA-g5mm-vmx4-3rg7 Improper handling of case sensitivity in Spring Framework

HIGH Published 2022-04-15 Modified 2024-05-15 Official page ↗
Aliases
CVE-2022-22968
Ecosystem
Maven
Packages
org.springframework:spring-context
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-178
Reviewed
2022-04-22

Affected packages

• Maven org.springframework:spring-context: >= 5.3.0, < 5.3.19 → fixed in 5.3.19 • Maven org.springframework:spring-context: < 5.2.21.RELEASE → fixed in 5.2.21.RELEASE

Description

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path. Versions 5.3.19 and 5.2.21 contain a patch for this issue.

Related

Alias · CVE (1)

  • CVE-2022-22968 In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a… vulnerability

Weakness · CWE (1)

  • CWE-178 Improper Handling of Case Sensitivity weakness

References