Denial of Service Vulnerability in Spring Framework by VMware
CVE-2022-22950

6.5MEDIUM

Key Information:

Vendor
Vmware
Status
Spring Framework
Vendor
CVE Published:
1 April 2022

Summary

In specific versions of Spring Framework, a specially crafted Spring Expression Language (SpEL) expression can be utilized to trigger a denial of service condition. This vulnerability allows attackers to exploit the framework's handling of SpEL, potentially causing resource exhaustion or application unavailability. It is crucial for developers and system administrators using affected versions of the Spring Framework to apply the latest updates or patches to mitigate this issue.

Affected Version(s)

Spring Framework Spring Framework versions 5.3.X prior to 5.3.17+ and all old and unsupported versions

References

https://tanzu.vmware.com/security/cve-2022-22950
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.