CVE-2024-22243
published 2024-02-23CVE-2024-22243: Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of…
PriorityP346high8.1CVSS 3.1
AVNACLPRNUIRSUCHIHAN
EPSS
3.97%
89.3th percentile
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | confluence_data_center | — | — |
| debian | libspring-java | — | — |
| spring | spring_framework | >= 5.3.x < 5.3.34 | 5.3.34 |
| spring | spring_framework | >= 6.0.x < 6.0.19 | 6.0.19 |
| spring | spring_framework | >= 6.1.x < 6.1.6 | 6.1.6 |
| vmware | spring_framework | < 5.3.33 | 5.3.33 |
| vmware | spring_framework | >= 6.0.0 < 6.0.18 | 6.0.18 |
| vmware | spring_framework | >= 6.1.0 < 6.1.5 | 6.1.5 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor HTTP traffic for open redirect or SSRF attempts targeting Spring Framework applications; the attack vector is remote over HTTP. ↗
- ·Debian distributions (bookworm, bullseye, forky, sid, trixie) remain open/unpatched for both CVE-2024-22259 and CVE-2024-22262 as of tracker data — Spring Framework deployments on these distros should be prioritized. ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
ghsa8.1HIGH
osv8.1HIGH
vendor_debian8.1LOW
vendor_oracle8.1HIGH
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Retail Applications Risk Matrix: Point of Sale (Spring Framework) — CVE-2024-22243
vendor_oracle·2025-04-15·CVSS 8.1
CVE-2024-22243 [HIGH] Oracle Oracle Retail Applications Risk Matrix: Point of Sale (Spring Framework) — CVE-2024-22243
Oracle Oracle Retail Applications Risk Matrix: Point of Sale (Spring Framework) vulnerability
CVE: CVE-2024-22243
CVSS: 8.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2025 (APR 2025)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Third Party (Spring Framework) — CVE-2024-22243
vendor_oracle·2024-07-15·CVSS 8.1
CVE-2024-22243 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: Third Party (Spring Framework) — CVE-2024-22243
Oracle Oracle Fusion Middleware Risk Matrix: Third Party (Spring Framework) vulnerability
CVE: CVE-2024-22243
CVSS: 8.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
Red Hat
springframework: URL Parsing with Host Validation
vendor_redhat·2024-04-16·CVSS 8.1
CVE-2024-22262 [HIGH] CWE-601 springframework: URL Parsing with Host Validation
springframework: URL Parsing with Host Validation
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
A flaw was found in the Spring Framework. Applications that use UriComponentsBuilder to parse an externally provided URL, for example, through a query parameter, and perform validation checks on the host of the parsed URL may be vulnerable to an
Oracle
Oracle Oracle Construction and Engineering Risk Matrix: Document Management (Spring Framework) — CVE-2024-22243
vendor_oracle·2024-04-15·CVSS 5.4
CVE-2024-22243 [HIGH] Oracle Oracle Construction and Engineering Risk Matrix: Document Management (Spring Framework) — CVE-2024-22243
Oracle Oracle Construction and Engineering Risk Matrix: Document Management (Spring Framework) vulnerability
CVE: CVE-2024-22243
CVSS: 5.4
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2024 (APR 2024)
Red Hat
springframework: URL Parsing with Host Validation
vendor_redhat·2024-03-16·CVSS 8.1
CVE-2024-22259 [HIGH] CWE-601 springframework: URL Parsing with Host Validation
springframework: URL Parsing with Host Validation
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
A vulnerability was found in Spring Framework. Affected versions of this package are vulnerable to an Open Redirect when using UriComponentsBuilder to parse an externally provided URL and perform validation checks on the host of the parsed URL.
Package: springframework (A-MQ Clients 2)
Red Hat
springframework: URL Parsing with Host Validation
vendor_redhat·2024-02-21·CVSS 8.1
CVE-2024-22243 [HIGH] CWE-601 springframework: URL Parsing with Host Validation
springframework: URL Parsing with Host Validation
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
A vulnerability was discovered in Spring Framework. Under certain conditions, an attacker might be able to trigger an open redirect. This issue can simplify the process of conducting a phishing attack against users of the deployment.
Statement: The open redirect vulnerability discovered in the Spring Framework poses a moderate severity issue due to its potential to facilitate phishing attacks. While it doesn
Debian
CVE-2024-22262: libspring-java - Applications that use UriComponentsBuilder to parse an externally provided URL (...
vendor_debian·2024·CVSS 8.1
CVE-2024-22262 [HIGH] CVE-2024-22262: libspring-java - Applications that use UriComponentsBuilder to parse an externally provided URL (...
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
Debian
CVE-2024-22243: libspring-java - Applications that use UriComponentsBuilder to parse an externally provided URL (...
vendor_debian·2024·CVSS 8.1
CVE-2024-22243 [HIGH] CVE-2024-22243: libspring-java - Applications that use UriComponentsBuilder to parse an externally provided URL (...
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
Debian
CVE-2024-22259: libspring-java - Applications that use UriComponentsBuilder in Spring Framework to parse an exter...
vendor_debian·2024·CVSS 8.1
CVE-2024-22259 [HIGH] CVE-2024-22259: libspring-java - Applications that use UriComponentsBuilder in Spring Framework to parse an exter...
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
Atlassian
CVE-2024-22243: SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Confluence Data Center and Server
vendor_atlassian·CVSS 8.1
CVE-2024-22243 [HIGH] CVE-2024-22243: SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Confluence Data Center and Server
CVE-2024-22243: SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Confluence Data Center and Server
SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Confluence Data Center and Server
CVE: CVE-2024-22243
Affected products: Confluence Data Center
GHSA
Spring Framework URL Parsing with Host Validation
ghsa·2024-04-16·CVSS 8.1
CVE-2024-22262 [HIGH] CWE-601 Spring Framework URL Parsing with Host Validation
Spring Framework URL Parsing with Host Validation
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
OSV
Spring Framework URL Parsing with Host Validation
osv·2024-04-16·CVSS 8.1
CVE-2024-22262 [HIGH] Spring Framework URL Parsing with Host Validation
Spring Framework URL Parsing with Host Validation
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
OSV
CVE-2024-22262: Applications that use UriComponentsBuilder to parse an externally provided URL (e
osv·2024-04-16·CVSS 8.1
CVE-2024-22262 [HIGH] CVE-2024-22262: Applications that use UriComponentsBuilder to parse an externally provided URL (e
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
OSV
Spring Framework URL Parsing with Host Validation Vulnerability
osv·2024-03-16·CVSS 8.1
CVE-2024-22259 [HIGH] Spring Framework URL Parsing with Host Validation Vulnerability
Spring Framework URL Parsing with Host Validation Vulnerability
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243, but with different input.
GHSA
Spring Framework URL Parsing with Host Validation Vulnerability
ghsa·2024-03-16·CVSS 8.1
CVE-2024-22259 [HIGH] CWE-601 Spring Framework URL Parsing with Host Validation Vulnerability
Spring Framework URL Parsing with Host Validation Vulnerability
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243, but with different input.
OSV
CVE-2024-22259: Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e
osv·2024-03-16·CVSS 8.1
CVE-2024-22259 [HIGH] CVE-2024-22259: Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
GHSA
Spring Web vulnerable to Open Redirect or Server Side Request Forgery
ghsa·2024-02-23
CVE-2024-22243 [HIGH] CWE-601 Spring Web vulnerable to Open Redirect or Server Side Request Forgery
Spring Web vulnerable to Open Redirect or Server Side Request Forgery
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks.
OSV
CVE-2024-22243: Applications that use UriComponentsBuilder to parse an externally provided URL (e
osv·2024-02-23·CVSS 8.1
CVE-2024-22243 [HIGH] CVE-2024-22243: Applications that use UriComponentsBuilder to parse an externally provided URL (e
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
OSV
Spring Web vulnerable to Open Redirect or Server Side Request Forgery
osv·2024-02-23
CVE-2024-22243 [HIGH] Spring Web vulnerable to Open Redirect or Server Side Request Forgery
Spring Web vulnerable to Open Redirect or Server Side Request Forgery
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks.
No detection rules found.
No public exploits indexed.
HackerOne
Incorrect Type Conversion in interpreting IPv4-mapped IPv6 addresses and below `curl` results in indeterminate SSRF vulnerabilities.
hackerone·2024-05-08·CVSS 9.8
[CRITICAL] Incorrect Type Conversion in interpreting IPv4-mapped IPv6 addresses and below `curl` results in indeterminate SSRF vulnerabilities.
Incorrect Type Conversion in interpreting IPv4-mapped IPv6 addresses and below `curl` results in indeterminate SSRF vulnerabilities.
## Summary:
Octal Type Handling of Errors in IPv4 Mapped IPv6 Addresses in curl allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many programs that rely on curl.
[RFC 4291](https://datatracker.ietf.org/doc/html/rfc4291#section-2-5-5) defines ways to embed an IPv4 address into IPv6 addresses. One of the methods defined in the RFC is to use IPv4-mapped IPv6 addresses, that have the following format:
```
| 80 bits | 16 | 32 bits |
+--------------------------------------+--------------------------+
|0000..............................0000|FFFF| IPv4 address |
+--------------------------------------+----+------------
Bugzilla
CVE-2024-22259 springframework: URL Parsing with Host Validation
bugzilla·2024-03-16·CVSS 8.1
CVE-2024-22259 [HIGH] CVE-2024-22259 springframework: URL Parsing with Host Validation
CVE-2024-22259 springframework: URL Parsing with Host Validation
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
https://spring.io/security/cve-2024-22259
Discussion:
This issue has been addressed in the following products:
Red Hat JBoss AMQ
Via RHSA-2024:2945 https://access.redhat.com/errata/RHSA-2024:2945
arXiv
Boosting Cybersecurity Vulnerability Scanning based on LLM-supported Static Application Security Testing
arxiv_fulltext·2024-11-22
Boosting Cybersecurity Vulnerability Scanning based on LLM-supported Static Application Security Testing
Boosting Cybersecurity Vulnerability Scanning based on LLM-supported Static Application Security Testing
1st Mete Keltek
University of Cologne
Cologne, Germany
2nd Rong Hu
Hunan University
Changsha, China
[email protected]
3rd Mohammadreza Fani Sani
Microsoft
Copenhagen, Denmark
[email protected]
4th Ziyue Li^* ^* Corresponding author.
University of Cologne
Cologne, Germany
[email protected]
## Abstract
In the fast-evolving landscape of cybersecurity, Large Language Models (LLM's) play a pivotal role, continually improving their ability to analyze software code. This paper introduces a novel approach to vulnerability scanning by integrating conservative SAST (Static Application Security Testing) scanners with LLM capabilities, resulting in the creation of LSAST
2024-02-23
Published