Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-CCGV-VJ62-XF9H
HistoryFeb 23, 2024 - 6:30 a.m.

Spring Web vulnerable to Open Redirect or Server Side Request Forgery

2024-02-2306:30:31
CWE-601
GitHub Advisory Database
github.com
88
spring
web
open redirect
server side request forgery
uricomponentsbuilder
validation checks
host
url
ssrf
attack
software

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

AI Score

7

Confidence

High

EPSS

0.001

Percentile

26.6%

JSON

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks.

Affected configurations

Vulners
Node
org.springframeworkspring-webRange≤5.2.25.RELEASE
OR
org.springframeworkspring-webRange5.3.0–5.3.32
OR
org.springframeworkspring-webRange6.0.0–6.0.17
OR
org.springframeworkspring-webRange6.1.0–6.1.4
VendorProductVersionCPE
org.springframeworkspring-web*cpe:2.3:a:org.springframework:spring-web:*:*:*:*:*:*:*:*

Related

prion 1
redhatcve 1
ibm 20
veracode 2
debiancve 3
osv 7
ubuntucve 3
atlassian 12
cve 3
cvelist 3
nessus 7
cgr 1
openvas 8
nvd 3
wolfi 1
vulnrichment 3
f5 1
github 2
hackerone 1
githubexploit 2
redhat 1
adobe 1
oracle 2
prion
prion
Open redirect
2024-02-23 05:15:00
redhatcve
redhatcve
CVE-2024-22243
2024-02-23 21:31:38
ibm
ibm
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in spring-web-5.3.15.jar
2024-06-05 20:40:33
Security Bulletin: Spring vulnerability in embedded components may affect IBM Business Automation Workflow - CVE-2024-22243
2024-06-11 09:50:01
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to open redirect vulnerability in VMware Tanzu Spring Framework ( CVE-2024-22243)
2024-06-28 16:18:07
veracode
veracode
Server Side Request Forgery (SSRF)
2024-02-26 05:35:16
Server Side Request Forgery (SSRF)
2024-03-20 06:01:52
debiancve
debiancve
CVE-2024-22243
2024-02-23 05:15:08
CVE-2024-22259
2024-03-16 05:15:20
CVE-2024-22262
2024-04-16 06:15:46
osv
osv
CGA-6v4j-fx6x-94x5
2024-06-06 12:24:43
CVE-2024-22243
2024-02-23 05:15:08
Spring Web vulnerable to Open Redirect or Server Side Request Forgery
2024-02-23 06:30:31
ubuntucve
ubuntucve
CVE-2024-22243
2024-02-23 00:00:00
CVE-2024-22259
2024-03-16 00:00:00
CVE-2024-22262
2024-04-16 00:00:00
atlassian
atlassian
Bitbucket is affected by CVE-2024-22243
2024-03-13 15:04:41
Jira - CVE-2024-22243
2024-03-21 18:45:13
SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Bamboo Data Center and Server
2024-04-11 08:11:41
cve
cve
CVE-2024-22243
2024-02-23 05:15:08
CVE-2024-22259
2024-03-16 05:15:20
CVE-2024-22262
2024-04-16 06:15:46
cvelist
cvelist
CVE-2024-22243 CVE-2024-22243: Spring Framework URL Parsing with Host Validation
2024-02-23 05:03:54
CVE-2024-22259 CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)
2024-03-16 04:40:08
CVE-2024-22262 CVE-2024-22262: Spring Framework URL Parsing with Host Validation
2024-04-16 05:54:12
nessus
nessus
Oracle Primavera Unifier Open Redirect (April 2024 CPU)
2024-04-17 00:00:00
Atlassian Confluence 1.0.1 < 7.19.23 / 7.20.x < 8.5.9 / 8.6.x < 8.9.1 (CONFSERVER-95942)
2024-06-27 00:00:00
Spring Framework < 5.3.32 / 6.0.x < 6.0.17 / 6.1.x < 6.1.4 Open Redirect (CVE-2024-22243)
2024-07-25 00:00:00
cgr
cgr
CVE-2024-22243 vulnerabilities
2024-05-19 03:07:16
openvas
openvas
VMware Spring Framework < 5.3.32, 6.0.x < 6.0.17, 6.1.x < 6.1.4 Open Redirect / SSRF Vulnerability - Windows
2024-02-22 00:00:00
VMware Spring Framework < 5.3.32, 6.0.x < 6.0.17, 6.1.x < 6.1.4 Open Redirect / SSRF Vulnerability - Linux
2024-02-22 00:00:00
VMware Spring Boot < 2.7.20.1, 3.0.x < 3.0.15.1, 3.1.x < 3.1.10, 3.2.x < 3.2.4 SSRF Vulnerability - Windows
2024-03-18 00:00:00
nvd
nvd
CVE-2024-22243
2024-02-23 05:15:08
CVE-2024-22259
2024-03-16 05:15:20
CVE-2024-22262
2024-04-16 06:15:46
wolfi
wolfi
CVE-2024-22243 vulnerabilities
2024-09-28 21:12:41
vulnrichment
vulnrichment
CVE-2024-22243 CVE-2024-22243: Spring Framework URL Parsing with Host Validation
2024-02-23 05:03:54
CVE-2024-22259 CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)
2024-03-16 04:40:08
CVE-2024-22262 CVE-2024-22262: Spring Framework URL Parsing with Host Validation
2024-04-16 05:54:12
f5
f5
K000139218 : CVE-2024-22243 Spring Framework vulnerability
2024-04-09 00:00:00
github
github
Spring Framework URL Parsing with Host Validation Vulnerability
2024-03-16 06:30:27
Spring Framework URL Parsing with Host Validation
2024-04-16 06:30:28
hackerone
hackerone
curl: Incorrect Type Conversion in interpreting IPv4-mapped IPv6 addresses and below `curl` results in indeterminate SSRF vulnerabilities.
2024-05-07 15:11:55
githubexploit
githubexploit
Exploit for CVE-2024-22234
2024-02-23 10:09:51
Exploit for CVE-2024-22243
2024-02-21 12:55:22
redhat
redhat
(RHSA-2024:3354) Important: Red Hat Fuse 7.13.0 release and security update
2024-05-23 22:44:00
adobe
adobe
APSB24-28 : Security update available for Adobe Experience Manager
2024-06-11 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - July 2024
2024-07-16 00:00:00
Oracle Critical Patch Update Advisory - April 2024
2024-04-16 00:00:00

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

AI Score

7

Confidence

High

EPSS

0.001

Percentile

26.6%

JSON
Related for GHSA-CCGV-VJ62-XF9H
prion1redhatcve1ibm20veracode2debiancve3osv7ubuntucve3atlassian12cve3cvelist3nessus7cgr1openvas8nvd3wolfi1vulnrichment3f51github2hackerone1githubexploit2redhat1adobe1oracle2