ghsa-r4q3-7g4q-x89m
Vulnerability from github
Published
2024-01-22 15:30
Modified
2024-06-17 17:18
Severity ?
Summary
Spring Framework server Web DoS Vulnerability
Details
In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
- the application uses Spring MVC
- Spring Security 6.1.6+ or 6.2.1+ is on the classpath
Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.
{ "affected": [ { "package": { "ecosystem": "Maven", "name": "org.springframework:spring-core" }, "ranges": [ { "events": [ { "introduced": "6.1.2" }, { "fixed": "6.1.3" } ], "type": "ECOSYSTEM" } ], "versions": [ "6.1.2" ] }, { "package": { "ecosystem": "Maven", "name": "org.springframework:spring-core" }, "ranges": [ { "events": [ { "introduced": "6.0.15" }, { "fixed": "6.0.16" } ], "type": "ECOSYSTEM" } ], "versions": [ "6.0.15" ] } ], "aliases": [ "CVE-2024-22233" ], "database_specific": { "cwe_ids": [], "github_reviewed": true, "github_reviewed_at": "2024-01-23T14:44:07Z", "nvd_published_at": "2024-01-22T13:15:25Z", "severity": "HIGH" }, "details": "In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nSpecifically, an application is vulnerable when all of the following are true:\n\n * the application uses Spring MVC\n * Spring Security 6.1.6+ or 6.2.1+ is on the classpath\n\n\nTypically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web\u00a0and org.springframework.boot:spring-boot-starter-security\u00a0dependencies to meet all conditions.\n\n\n", "id": "GHSA-r4q3-7g4q-x89m", "modified": "2024-06-17T17:18:05Z", "published": "2024-01-22T15:30:23Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22233" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20240614-0005" }, { "type": "WEB", "url": "https://spring.io/security/cve-2024-22233" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "Spring Framework server Web DoS Vulnerability" }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.