Improper Control of Generation of Code ('Code Injection') in Spring Framework

2022-05-1703:28:34

Google

osv.dev

9.6 High

AI Score

Confidence

High

0.036 Low

EPSS

Percentile

91.8%

JSON

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

CPENameOperatorVersion
org.springframework:springeq2.5.3
org.springframework:springeq2.5
org.springframework:springeq2.5.6.SEC03
org.springframework:springeq2.5.4
org.springframework:springeq2.5.1
org.springframework:springeq2.5.2
org.springframework:springeq2.5.5
org.springframework:springeq2.5.6.SEC02
org.springframework:springeq2.5.6.SEC01
org.springframework:springeq2.5.6

Name	Operator	Version
org.springframework:spring	eq	2.5.3
org.springframework:spring	eq	2.5
org.springframework:spring	eq	2.5.6.SEC03
org.springframework:spring	eq	2.5.4
org.springframework:spring	eq	2.5.1
org.springframework:spring	eq	2.5.2
org.springframework:spring	eq	2.5.5
org.springframework:spring	eq	2.5.6.SEC02
org.springframework:spring	eq	2.5.6.SEC01
org.springframework:spring	eq	2.5.6