Log in Start free

Vulnerability · Published May 27, 2021 · Assigned by vmware

CVE-2021-22118

High 7.8

In plain English

A high-severity privilege mismanagement in Spring Framework. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.4%top 67.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.springframework:spring-web5.2.15GHSA-gfwj-fwqj-fp3v
Mavenorg.springframework:spring-web5.3.7GHSA-gfwj-fwqj-fp3v

Affected products (as reported)

VendorProductVersions
n/a Spring Framework Spring Framework versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7

Weakness: CWE-269

References