Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
veracodeVeracode Vulnerability DatabaseVERACODE:45624
HistoryFeb 26, 2024 - 5:35 a.m.

Server Side Request Forgery (SSRF)

2024-02-2605:35:16
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
68
spring-web
open redirect
host validation
ssrf

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

org.springframework:spring-web is vulnerable to Open Redirect. The vulnerability is due to insufficient validation checks of the host URL within UriComponentsBuilder.java. If an application utilizes the host validation checks, an attacker can perform an open redirect or Server-Side Request Forgery (SSRF) attack.

Related

osv 6
cgr 1
atlassian 8
github 3
ibm 17
openvas 8
redhatcve 1
debiancve 3
prion 1
f5 1
ubuntucve 3
cvelist 3
cve 3
nessus 5
nvd 3
wolfi 1
githubexploit 1
veracode 1
vulnrichment 2
hackerone 1
redhat 1
adobe 1
oracle 1
osv
osv
Spring Web vulnerable to Open Redirect or Server Side Request Forgery
2024-02-23 06:30:31
CVE-2024-22243
2024-02-23 05:15:08
CVE-2024-22259
2024-03-16 05:15:20
cgr
cgr
CVE-2024-22243 vulnerabilities
2024-05-19 03:07:16
atlassian
atlassian
SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Bamboo Data Center and Server
2024-04-11 08:11:41
SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Confluence Data Center and Server
2024-06-07 04:11:42
Bitbucket is affected by CVE-2024-22243
2024-03-13 15:04:41
github
github
Spring Web vulnerable to Open Redirect or Server Side Request Forgery
2024-02-23 06:30:31
Spring Framework URL Parsing with Host Validation Vulnerability
2024-03-16 06:30:27
Spring Framework URL Parsing with Host Validation
2024-04-16 06:30:28
ibm
ibm
Security Bulletin: Spring vulnerability in embedded components may affect IBM Business Automation Workflow - CVE-2024-22243
2024-06-11 09:50:01
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in spring-web-5.3.15.jar
2024-06-05 20:40:33
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to open redirect vulnerability in VMware Tanzu Spring Framework ( CVE-2024-22243)
2024-06-21 15:14:57
openvas
openvas
VMware Spring Framework < 5.3.32, 6.0.x < 6.0.17, 6.1.x < 6.1.4 Open Redirect / SSRF Vulnerability - Windows
2024-02-22 00:00:00
VMware Spring Framework < 5.3.32, 6.0.x < 6.0.17, 6.1.x < 6.1.4 Open Redirect / SSRF Vulnerability - Linux
2024-02-22 00:00:00
VMware Spring Boot < 2.7.20.1, 3.0.x < 3.0.15.1, 3.1.x < 3.1.10, 3.2.x < 3.2.4 SSRF Vulnerability - Windows
2024-03-18 00:00:00
redhatcve
redhatcve
CVE-2024-22243
2024-02-23 21:31:38
debiancve
debiancve
CVE-2024-22243
2024-02-23 05:15:08
CVE-2024-22259
2024-03-16 05:15:20
CVE-2024-22262
2024-04-16 06:15:46
prion
prion
Open redirect
2024-02-23 05:15:00
f5
f5
K000139218 : CVE-2024-22243 Spring Framework vulnerability
2024-04-09 00:00:00
ubuntucve
ubuntucve
CVE-2024-22243
2024-02-23 00:00:00
CVE-2024-22259
2024-03-16 00:00:00
CVE-2024-22262
2024-04-16 00:00:00
cvelist
cvelist
CVE-2024-22243 CVE-2024-22243: Spring Framework URL Parsing with Host Validation
2024-02-23 05:03:54
CVE-2024-22259 CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)
2024-03-16 04:40:08
CVE-2024-22262 CVE-2024-22262: Spring Framework URL Parsing with Host Validation
2024-04-16 05:54:12
cve
cve
CVE-2024-22243
2024-02-23 05:15:08
CVE-2024-22259
2024-03-16 05:15:20
CVE-2024-22262
2024-04-16 06:15:46
nessus
nessus
Oracle Primavera Unifier Open Redirect (April 2024 CPU)
2024-04-17 00:00:00
Atlassian Confluence 1.0.1 < 7.19.23 / 7.20.x < 8.5.9 / 8.6.x < 8.9.1 (CONFSERVER-95942)
2024-06-27 00:00:00
Atlassian Confluence 1.0.1 < 7.19.23 / 7.20.x < 8.5.9 / 8.6.x < 8.9.1 (CONFSERVER-95943)
2024-06-27 00:00:00
nvd
nvd
CVE-2024-22243
2024-02-23 05:15:08
CVE-2024-22259
2024-03-16 05:15:20
CVE-2024-22262
2024-04-16 06:15:46
wolfi
wolfi
CVE-2024-22243 vulnerabilities
2024-06-29 09:08:33
githubexploit
githubexploit
Exploit for CVE-2024-22243
2024-02-21 12:55:22
veracode
veracode
Server Side Request Forgery (SSRF)
2024-03-20 06:01:52
vulnrichment
vulnrichment
CVE-2024-22259 CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)
2024-03-16 04:40:08
CVE-2024-22262 CVE-2024-22262: Spring Framework URL Parsing with Host Validation
2024-04-16 05:54:12
hackerone
hackerone
curl: Incorrect Type Conversion in interpreting IPv4-mapped IPv6 addresses and below `curl` results in indeterminate SSRF vulnerabilities.
2024-05-07 15:11:55
redhat
redhat
(RHSA-2024:3354) Important: Red Hat Fuse 7.13.0 release and security update
2024-05-23 22:44:00
adobe
adobe
APSB24-28 : Security update available for Adobe Experience Manager
2024-06-11 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - April 2024
2024-04-16 00:00:00

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON
Related for VERACODE:45624
osv6cgr1atlassian8github3ibm17openvas8redhatcve1debiancve3prion1f51ubuntucve3cvelist3cve3nessus5nvd3wolfi1githubexploit1veracode1vulnrichment2hackerone1redhat1adobe1oracle1