Spring Framework vulnerable to denial of service

2023-04-1321:30:27

Google

osv.dev

spring framework

denial of service

spel expression

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.003 Low

EPSS

Percentile

70.0%

JSON

In Spring Framework versions prior to 5.2.24.release+ , 5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial-of-service (DoS) condition.

CPENameOperatorVersion
org.springframework:spring-expressioneq5.2.1.RELEASE
org.springframework:spring-expressioneq4.3.10.RELEASE
org.springframework:spring-expressioneq3.2.16.RELEASE
org.springframework:spring-expressioneq5.2.9.RELEASE
org.springframework:spring-expressioneq5.0.13.RELEASE
org.springframework:spring-expressioneq5.1.0.RELEASE
org.springframework:spring-expressioneq5.3.6
org.springframework:spring-expressioneq4.1.4.RELEASE
org.springframework:spring-expressioneq5.2.23.RELEASE
org.springframework:spring-expressioneq5.3.8

Name	Operator	Version
org.springframework:spring-expression	eq	5.2.1.RELEASE
org.springframework:spring-expression	eq	4.3.10.RELEASE
org.springframework:spring-expression	eq	3.2.16.RELEASE
org.springframework:spring-expression	eq	5.2.9.RELEASE
org.springframework:spring-expression	eq	5.0.13.RELEASE
org.springframework:spring-expression	eq	5.1.0.RELEASE
org.springframework:spring-expression	eq	5.3.6
org.springframework:spring-expression	eq	4.1.4.RELEASE
org.springframework:spring-expression	eq	5.2.23.RELEASE
org.springframework:spring-expression	eq	5.3.8