Skip to content

spring-web-4.3.30.RELEASE.jar: 8 vulnerabilities (highest severity is: 9.8) reachable #17

Open
Open
spring-web-4.3.30.RELEASE.jar: 8 vulnerabilities (highest severity is: 9.8) reachable#17
Labels
Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

Description

@dev-mend-for-github-com
dev-mend-for-github-com
bot
opened on Aug 3, 2023
Vulnerable Library - spring-web-4.3.30.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/4.3.30.RELEASE/spring-web-4.3.30.RELEASE.jar

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Vulnerabilities

Vulnerability Severity CVSS Dependency Type Fixed in (spring-web version) Remediation Possible** Reachability
CVE-2016-1000027 Critical 9.8 spring-web-4.3.30.RELEASE.jar Direct org.springframework:spring-web:6.0.0 ✅

Reachable
CVE-2024-38828 Medium 5.3 spring-web-4.3.30.RELEASE.jar Direct N/A ❌

Reachable
CVE-2024-38809 Medium 5.3 spring-web-4.3.30.RELEASE.jar Direct org.springframework:spring-web:6.0.23,org.springframework:spring-web:6.1.12,org.springframework:spring-web:5.3.38 ✅

Reachable
CVE-2024-38820 Low 3.1 spring-web-4.3.30.RELEASE.jar Direct org.springframework:spring-context:6.1.14 ✅

Reachable
CVE-2024-22262 High 8.1 spring-web-4.3.30.RELEASE.jar Direct org.springframework:spring-web:6.1.6,org.springframework:spring-web:6.0.19,org.springframework:spring-web:5.3.34 ❌

Unreachable
CVE-2024-22259 High 8.1 spring-web-4.3.30.RELEASE.jar Direct org.springframework:spring-web:6.1.5,org.springframework:spring-web:6.0.18,org.springframework:spring-web:5.3.33 ✅

Unreachable
CVE-2024-22243 High 8.1 spring-web-4.3.30.RELEASE.jar Direct org.springframework:spring-web:6.1.4,org.springframework:spring-web:5.3.32,org.springframework:spring-web:6.0.17 ✅

Unreachable
CVE-2021-22096 Medium 4.3 spring-web-4.3.30.RELEASE.jar Direct org.springframework:spring-core:5.3.11,org.springframework:spring-core:5.3.11,org.springframework:spring:5.3.11,org.springframework:spring:5.3.11,org.springframework:spring-core:5.3.11 ❌

Unreachable

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2016-1000027

Vulnerable Library - spring-web-4.3.30.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/4.3.30.RELEASE/spring-web-4.3.30.RELEASE.jar

Dependency Hierarchy:

  • ❌ spring-web-4.3.30.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DataBaseServer (Application)
  -> org.springframework.http.ResponseEntity (Extension)
   -> ❌ org.springframework.http.ResponseEntity$1 (Vulnerable Component)

Vulnerability Details

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

Publish Date: 2020-01-02

URL: CVE-2016-1000027

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4wrc-f8pq-fpqp

Release Date: 2020-01-02

Fix Resolution: org.springframework:spring-web:6.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-38828

Vulnerable Library - spring-web-4.3.30.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/4.3.30.RELEASE/spring-web-4.3.30.RELEASE.jar

Dependency Hierarchy:

  • ❌ spring-web-4.3.30.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DataBaseServer (Application)
  -> org.springframework.http.ResponseEntity (Extension)
   -> org.springframework.http.ResponseEntity$HeadersBuilder (Extension)
    -> ❌ org.springframework.http.CacheControl (Vulnerable Component)

Vulnerability Details

Spring MVC controller methods with an @⁠RequestBody byte[] method parameter are vulnerable to a DoS attack.

Publish Date: 2024-11-18

URL: CVE-2024-38828

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

CVE-2024-38809

Vulnerable Library - spring-web-4.3.30.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/4.3.30.RELEASE/spring-web-4.3.30.RELEASE.jar

Dependency Hierarchy:

  • ❌ spring-web-4.3.30.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DataBaseServer (Application)
  -> org.springframework.http.ResponseEntity (Extension)
   -> ❌ org.springframework.http.HttpHeaders (Vulnerable Component)

Vulnerability Details

Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.
Users of affected versions should upgrade to the corresponding fixed version.
Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.

Publish Date: 2024-09-27

URL: CVE-2024-38809

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2rmj-mq67-h97g

Release Date: 2024-09-27

Fix Resolution: org.springframework:spring-web:6.0.23,org.springframework:spring-web:6.1.12,org.springframework:spring-web:5.3.38

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-38820

Vulnerable Library - spring-web-4.3.30.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/4.3.30.RELEASE/spring-web-4.3.30.RELEASE.jar

Dependency Hierarchy:

  • ❌ spring-web-4.3.30.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DataBaseServer (Application)
  -> org.springframework.http.HttpStatus (Extension)
   -> ❌ org.springframework.http.HttpStatus$Series (Vulnerable Component)

Vulnerability Details

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

Publish Date: 2024-10-18

URL: CVE-2024-38820

CVSS 3 Score Details (3.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4gc7-5j7h-4qph

Release Date: 2024-10-18

Fix Resolution: org.springframework:spring-context:6.1.14

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-22262

Vulnerable Library - spring-web-4.3.30.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/4.3.30.RELEASE/spring-web-4.3.30.RELEASE.jar

Dependency Hierarchy:

  • ❌ spring-web-4.3.30.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259  and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.

Publish Date: 2024-04-16

URL: CVE-2024-22262

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2wrp-6fg6-hmc5

Release Date: 2024-04-16

Fix Resolution: org.springframework:spring-web:6.1.6,org.springframework:spring-web:6.0.19,org.springframework:spring-web:5.3.34

CVE-2024-22259

Vulnerable Library - spring-web-4.3.30.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/4.3.30.RELEASE/spring-web-4.3.30.RELEASE.jar

Dependency Hierarchy:

  • ❌ spring-web-4.3.30.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.

Publish Date: 2024-03-16

URL: CVE-2024-22259

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hgjh-9rj2-g67j

Release Date: 2024-03-16

Fix Resolution: org.springframework:spring-web:6.1.5,org.springframework:spring-web:6.0.18,org.springframework:spring-web:5.3.33

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-22243

Vulnerable Library - spring-web-4.3.30.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/4.3.30.RELEASE/spring-web-4.3.30.RELEASE.jar

Dependency Hierarchy:

  • ❌ spring-web-4.3.30.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

Publish Date: 2024-02-23

URL: CVE-2024-22243

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-ccgv-vj62-xf9h

Release Date: 2024-02-23

Fix Resolution: org.springframework:spring-web:6.1.4,org.springframework:spring-web:5.3.32,org.springframework:spring-web:6.0.17

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-22096

Vulnerable Library - spring-web-4.3.30.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/4.3.30.RELEASE/spring-web-4.3.30.RELEASE.jar

Dependency Hierarchy:

  • ❌ spring-web-4.3.30.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

Publish Date: 2021-10-28

URL: CVE-2021-22096

CVSS 3 Score Details (4.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rfmp-97jj-h8m6

Release Date: 2021-10-28

Fix Resolution: org.springframework:spring-core:5.3.11,org.springframework:spring-core:5.3.11,org.springframework:spring:5.3.11,org.springframework:spring:5.3.11,org.springframework:spring-core:5.3.11

⛑️Automatic Remediation will be attempted for this issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions