Vulnerability · Published Apr 14, 2022 · Assigned by vmware
CVE-2022-22968
Medium 5.3
In plain English
A medium-severity security flaw in Spring Framework. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.7% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libspring-java | no fix listed | DEBIAN-CVE-2022-22968 |
| Debian:13 | libspring-java | no fix listed | DEBIAN-CVE-2022-22968 |
| Debian:14 | libspring-java | no fix listed | DEBIAN-CVE-2022-22968 |
| Maven | org.springframework:spring-context | 5.3.19 | GHSA-g5mm-vmx4-3rg7 |
| Maven | org.springframework:spring-context | 5.2.21.RELEASE | GHSA-g5mm-vmx4-3rg7 |
| Ubuntu:25.10 | libspring-java | no fix listed | UBUNTU-CVE-2022-22968 |
| Ubuntu:26.04:LTS | libspring-java | no fix listed | UBUNTU-CVE-2022-22968 |
| Ubuntu:26.10 | libspring-java | no fix listed | UBUNTU-CVE-2022-22968 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Spring Framework | Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions |
References
- https://tanzu.vmware.com/security/cve-2022-22968 x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220602-0004/ x_refsource_CONFIRM