CVE-2022-22968
published 2022-04-14CVE-2022-22968: In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case…
PriorityP432medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
5.67%
92.1th percentile
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libspring-java | — | — |
| oracle | mysql_enterprise_monitor | <= 8.0.29 | — |
| spring | spring_framework | 5.3.0 – 5.3.42 | — |
| spring | spring_framework | 6.0.0 – 6.0.27 | — |
| spring | spring_framework | 6.1.0 – 6.1.19 | — |
| spring | spring_framework | 6.2.0 – 6.2.6 | — |
| vmware | spring | >= 5.3.x < 5.3.41 | 5.3.41 |
| vmware | spring | >= 6.0.x < 6.0.25 | 6.0.25 |
| vmware | spring | >= 6.1.x < 6.1.14 | 6.1.14 |
| vmware | spring_framework | < 5.2.0 | 5.2.0 |
| vmware | spring_framework | 5.2.0 – 5.2.20 | — |
| vmware | spring_framework | >= 5.3.0 < 5.3.41 | 5.3.41 |
| vmware | spring_framework | 5.3.0 – 5.3.18 | — |
| vmware | spring_framework | >= 6.0.0 < 6.0.25 | 6.0.25 |
| vmware | spring_framework | >= 6.1.0 < 6.1.14 | 6.1.14 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
ghsa5.3MEDIUM
osv5.3MEDIUM
vendor_debian5.3LOW
vendor_oracle5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2024-38820: libspring-java - The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case ins...
vendor_debian·2024·CVSS 5.3
CVE-2024-38820 [MEDIUM] CVE-2024-38820: libspring-java - The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case ins...
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Samples (Spring Framework) — CVE-2022-22968
vendor_oracle·2022-10-15·CVSS 5.3
CVE-2022-22968 [MEDIUM] Oracle Oracle Fusion Middleware Risk Matrix: Samples (Spring Framework) — CVE-2022-22968
Oracle Oracle Fusion Middleware Risk Matrix: Samples (Spring Framework) vulnerability
CVE: CVE-2022-22968
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2022 (OCT 2022)
Oracle
Oracle Oracle MySQL Risk Matrix: Service Manager (Spring Framework) — CVE-2022-22968
vendor_oracle·2022-07-15·CVSS 5.3
CVE-2022-22968 [MEDIUM] Oracle Oracle MySQL Risk Matrix: Service Manager (Spring Framework) — CVE-2022-22968
Oracle Oracle MySQL Risk Matrix: Service Manager (Spring Framework) vulnerability
CVE: CVE-2022-22968
CVSS: 5.3
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2022 (JUL 2022)
Red Hat
Framework: Data Binding Rules Vulnerability
vendor_redhat·2022-04-13·CVSS 5.3
CVE-2022-22968 [MEDIUM] CWE-20 Framework: Data Binding Rules Vulnerability
Framework: Data Binding Rules Vulnerability
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
Package: springframework (A-MQ Clients 2) - Not affected
Package: springframework (Logging Subsystem for Red Hat OpenShift) - Fix deferred
Package: springframework (Red Hat build of Quarkus) - Not affected
Package: springframework (Red Hat Data Grid 8) - Not affected
Package: springframework (Red Hat Decision Manager 7) - Fix deferred
Package: s
Debian
CVE-2022-22968: libspring-java - In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupport...
vendor_debian·2022·CVSS 5.3
CVE-2022-22968 [MEDIUM] CVE-2022-22968: libspring-java - In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupport...
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
OSV
Spring Framework DataBinder Case Sensitive Match Exception
osv·2024-10-18·CVSS 5.3
CVE-2024-38820 [MEDIUM] Spring Framework DataBinder Case Sensitive Match Exception
Spring Framework DataBinder Case Sensitive Match Exception
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
GHSA
Spring Framework DataBinder Case Sensitive Match Exception
ghsa·2024-10-18·CVSS 5.3
CVE-2024-38820 [MEDIUM] CWE-178 Spring Framework DataBinder Case Sensitive Match Exception
Spring Framework DataBinder Case Sensitive Match Exception
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
OSV
CVE-2024-38820: The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive
osv·2024-10-18·CVSS 5.3
CVE-2024-38820 [MEDIUM] CVE-2024-38820: The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
OSV
Improper handling of case sensitivity in Spring Framework
osv·2022-04-15
CVE-2022-22968 [HIGH] Improper handling of case sensitivity in Spring Framework
Improper handling of case sensitivity in Spring Framework
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path. Versions 5.3.19 and 5.2.21 contain a patch for this issue.
GHSA
Improper handling of case sensitivity in Spring Framework
ghsa·2022-04-15
CVE-2022-22968 [HIGH] CWE-178 Improper handling of case sensitivity in Spring Framework
Improper handling of case sensitivity in Spring Framework
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path. Versions 5.3.19 and 5.2.21 contain a patch for this issue.
OSV
CVE-2022-22968: In Spring Framework versions 5
osv·2022-04-14·CVSS 5.3
CVE-2022-22968 [MEDIUM] CVE-2022-22968: In Spring Framework versions 5
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://security.netapp.com/advisory/ntap-20220602-0004/https://tanzu.vmware.com/security/cve-2022-22968https://www.oracle.com/security-alerts/cpujul2022.htmlhttps://security.netapp.com/advisory/ntap-20220602-0004/https://tanzu.vmware.com/security/cve-2022-22968https://www.oracle.com/security-alerts/cpujul2022.html
2022-04-14
Published