Vulnerability · Published Nov 8, 2021 · Assigned by vmware
CVE-2021-22051
Medium 6.5
In plain English
A medium-severity security flaw in Spring Cloud Gateway. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.7%top 47.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-gateway | 3.0.5 | GHSA-2r2v-q399-qq93 |
| Maven | org.springframework.cloud:spring-cloud-gateway | 2.2.10.RELEASE0.5 | GHSA-2r2v-q399-qq93 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Spring Cloud Gateway | 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older versions |
References
- https://tanzu.vmware.com/security/cve-2021-22051 x_refsource_MISC