Vulnerability · Published Jul 9, 2024 · Assigned by vmware
CVE-2024-22271Spring Cloud Function Web DOS Vulnerability
High 8.2
In plain English
A high-severity improper input validation in Spring Cloud Function Framework from Spring by VMware Tanzu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions. Specifically, an application is vulnerable when all of the following are true: User is using Spring Cloud Function Web module Affected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8 References https://spring.io/security/cve-2022-22979 https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/ History 2020-01-16: Initial vulnerability report published.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-function-context | 4.0.8 | GHSA-j4r7-p9fp-w3f3 |
| Maven | org.springframework.cloud:spring-cloud-function-context | 4.1.2 | GHSA-j4r7-p9fp-w3f3 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring by VMware Tanzu | Spring Cloud Function Framework | Spring Cloud Function Framework 4.1.0-4.1.2, Spring Cloud Function Framework 4.0.0-4.0.8 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N