Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.springframework/spring-core@4.2.0.RELEASE
Typemaven
Namespaceorg.springframework
Namespring-core
Version4.2.0.RELEASE
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version5.2.24.RELEASE
Latest_non_vulnerable_version6.2.11
Affected_by_vulnerabilities
0
url VCID-3rev-eg6f-tkb7
vulnerability_id VCID-3rev-eg6f-tkb7
summary Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
references
0
reference_url https://access.redhat.com/errata/RHSA-2018:1320
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2018:1320
1
reference_url https://access.redhat.com/errata/RHSA-2018:2939
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2018:2939
2
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1275.json
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1275.json
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-1275
reference_id
reference_type
scores
0
value 0.38064
scoring_system epss
scoring_elements 0.97216
published_at 2026-04-12T12:55:00Z
1
value 0.38064
scoring_system epss
scoring_elements 0.97212
published_at 2026-04-09T12:55:00Z
2
value 0.38064
scoring_system epss
scoring_elements 0.97211
published_at 2026-04-08T12:55:00Z
3
value 0.38064
scoring_system epss
scoring_elements 0.97201
published_at 2026-04-07T12:55:00Z
4
value 0.38064
scoring_system epss
scoring_elements 0.972
published_at 2026-04-04T12:55:00Z
5
value 0.38064
scoring_system epss
scoring_elements 0.97194
published_at 2026-04-02T12:55:00Z
6
value 0.38064
scoring_system epss
scoring_elements 0.97188
published_at 2026-04-01T12:55:00Z
7
value 0.38064
scoring_system epss
scoring_elements 0.97227
published_at 2026-04-18T12:55:00Z
8
value 0.38064
scoring_system epss
scoring_elements 0.97225
published_at 2026-04-16T12:55:00Z
9
value 0.38064
scoring_system epss
scoring_elements 0.97217
published_at 2026-04-13T12:55:00Z
10
value 0.38064
scoring_system epss
scoring_elements 0.97231
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-1275
4
reference_url https://github.com/spring-projects/spring-framework
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework
5
reference_url https://github.com/spring-projects/spring-framework/commit/0009806debb578e884f6dc98bd1f2dc668020021
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/0009806debb578e884f6dc98bd1f2dc668020021
6
reference_url https://github.com/spring-projects/spring-framework/commit/1db7e02de3eb0c011ee6681f5a12eb9d166fea8
reference_id
reference_type
scores
url https://github.com/spring-projects/spring-framework/commit/1db7e02de3eb0c011ee6681f5a12eb9d166fea8
7
reference_url https://github.com/spring-projects/spring-framework/commit/d3acf45ea4db51fa5c4cbd0bc0e7b6d9ef805e6
reference_id
reference_type
scores
url https://github.com/spring-projects/spring-framework/commit/d3acf45ea4db51fa5c4cbd0bc0e7b6d9ef805e6
8
reference_url https://github.com/spring-projects/spring-framework/commit/e0de9126ed8cf25cf141d3e66420da94e350708a
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/e0de9126ed8cf25cf141d3e66420da94e350708a
9
reference_url https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe@%3Cissues.activemq.apache.org%3E
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe@%3Cissues.activemq.apache.org%3E
10
reference_url https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c@%3Cissues.activemq.apache.org%3E
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c@%3Cissues.activemq.apache.org%3E
11
reference_url https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3Cissues.activemq.apache.org%3E
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3Cissues.activemq.apache.org%3E
12
reference_url https://web.archive.org/web/20190901081835/http://www.securitytracker.com/id/1041301
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20190901081835/http://www.securitytracker.com/id/1041301
13
reference_url https://web.archive.org/web/20200227033125/http://www.securityfocus.com/bid/103771
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200227033125/http://www.securityfocus.com/bid/103771
14
reference_url https://www.oracle.com/security-alerts/cpujul2020.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpujul2020.html
15
reference_url https://www.oracle.com/security-alerts/cpuoct2021.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpuoct2021.html
16
reference_url https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
17
reference_url https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
18
reference_url http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
19
reference_url http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
20
reference_url http://www.securityfocus.com/bid/103771
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/103771
21
reference_url http://www.securitytracker.com/id/1041301
reference_id
reference_type
scores
url http://www.securitytracker.com/id/1041301
22
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1565307
reference_id 1565307
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1565307
23
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-1275
reference_id CVE-2018-1275
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-1275
24
reference_url https://pivotal.io/security/cve-2018-1275
reference_id CVE-2018-1275
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://pivotal.io/security/cve-2018-1275
25
reference_url https://github.com/advisories/GHSA-3rmv-2pg5-xvqj
reference_id GHSA-3rmv-2pg5-xvqj
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-3rmv-2pg5-xvqj
fixed_packages
0
url pkg:maven/org.springframework/spring-core@4.3.16
purl pkg:maven/org.springframework/spring-core@4.3.16
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.3.16
1
url pkg:maven/org.springframework/spring-core@4.3.16.RELEASE
purl pkg:maven/org.springframework/spring-core@4.3.16.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cyjt-4vjn-mbc7
3
vulnerability VCID-k17s-ttg2-ubgj
4
vulnerability VCID-w6br-v2gm-j7gr
5
vulnerability VCID-y3uz-etva-sufh
6
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.3.16.RELEASE
2
url pkg:maven/org.springframework/spring-core@5.0.5
purl pkg:maven/org.springframework/spring-core@5.0.5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.0.5
3
url pkg:maven/org.springframework/spring-core@5.0.5.RELEASE
purl pkg:maven/org.springframework/spring-core@5.0.5.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-859k-nee7-e7h8
2
vulnerability VCID-c74k-e1me-pfb2
3
vulnerability VCID-cyjt-4vjn-mbc7
4
vulnerability VCID-f3g5-hamr-6yar
5
vulnerability VCID-k17s-ttg2-ubgj
6
vulnerability VCID-w6br-v2gm-j7gr
7
vulnerability VCID-y3uz-etva-sufh
8
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.0.5.RELEASE
aliases CVE-2018-1275, GHSA-3rmv-2pg5-xvqj
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3rev-eg6f-tkb7
1
url VCID-6ysx-5wcw-f7b5
vulnerability_id VCID-6ysx-5wcw-f7b5
summary 
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
In spring framework versions prior to 5.2.24 release+,5.3.27+ and 6.0.8+, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-20863.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-20863.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-20863
reference_id
reference_type
scores
0
value 0.00783
scoring_system epss
scoring_elements 0.73697
published_at 2026-04-02T12:55:00Z
1
value 0.00783
scoring_system epss
scoring_elements 0.73729
published_at 2026-04-08T12:55:00Z
2
value 0.00783
scoring_system epss
scoring_elements 0.73694
published_at 2026-04-07T12:55:00Z
3
value 0.00783
scoring_system epss
scoring_elements 0.73721
published_at 2026-04-04T12:55:00Z
4
value 0.00783
scoring_system epss
scoring_elements 0.73737
published_at 2026-04-13T12:55:00Z
5
value 0.00783
scoring_system epss
scoring_elements 0.73745
published_at 2026-04-12T12:55:00Z
6
value 0.00783
scoring_system epss
scoring_elements 0.73763
published_at 2026-04-11T12:55:00Z
7
value 0.00783
scoring_system epss
scoring_elements 0.73742
published_at 2026-04-09T12:55:00Z
8
value 0.00936
scoring_system epss
scoring_elements 0.76214
published_at 2026-04-18T12:55:00Z
9
value 0.00936
scoring_system epss
scoring_elements 0.7621
published_at 2026-04-16T12:55:00Z
10
value 0.00936
scoring_system epss
scoring_elements 0.76207
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-20863
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20863
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20863
3
reference_url https://github.com/spring-projects/spring-framework
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework
4
reference_url https://github.com/spring-projects/spring-framework/commit/965a6392757d20f9db19241126fcc719a51eac15
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/965a6392757d20f9db19241126fcc719a51eac15
5
reference_url https://github.com/spring-projects/spring-framework/commit/b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e
6
reference_url https://github.com/spring-projects/spring-framework/commit/ebc82654282bda547fbc20a9749ab1bda886a46f
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/ebc82654282bda547fbc20a9749ab1bda886a46f
7
reference_url https://security.netapp.com/advisory/ntap-20240524-0015
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20240524-0015
8
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2187742
reference_id 2187742
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2187742
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-20863
reference_id CVE-2023-20863
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-20863
10
reference_url https://spring.io/security/cve-2023-20863
reference_id CVE-2023-20863
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-07T16:47:31Z/
url https://spring.io/security/cve-2023-20863
11
reference_url https://github.com/advisories/GHSA-wxqc-pxw9-g2p8
reference_id GHSA-wxqc-pxw9-g2p8
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-wxqc-pxw9-g2p8
12
reference_url https://security.netapp.com/advisory/ntap-20240524-0015/
reference_id ntap-20240524-0015
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-07T16:47:31Z/
url https://security.netapp.com/advisory/ntap-20240524-0015/
13
reference_url https://access.redhat.com/errata/RHSA-2023:2099
reference_id RHSA-2023:2099
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:2099
14
reference_url https://access.redhat.com/errata/RHSA-2023:2100
reference_id RHSA-2023:2100
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:2100
fixed_packages
0
url pkg:maven/org.springframework/spring-core@5.2.24.RELEASE
purl pkg:maven/org.springframework/spring-core@5.2.24.RELEASE
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.2.24.RELEASE
1
url pkg:maven/org.springframework/spring-core@5.3.27
purl pkg:maven/org.springframework/spring-core@5.3.27
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-k2en-h5n1-r7gr
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.3.27
2
url pkg:maven/org.springframework/spring-core@6.0.8
purl pkg:maven/org.springframework/spring-core@6.0.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-k2en-h5n1-r7gr
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@6.0.8
aliases CVE-2023-20863, GHSA-wxqc-pxw9-g2p8
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6ysx-5wcw-f7b5
2
url VCID-c74k-e1me-pfb2
vulnerability_id VCID-c74k-e1me-pfb2
summary 
Improper Handling of Case Sensitivity
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22968.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22968.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-22968
reference_id
reference_type
scores
0
value 0.2051
scoring_system epss
scoring_elements 0.95572
published_at 2026-04-18T12:55:00Z
1
value 0.2051
scoring_system epss
scoring_elements 0.95566
published_at 2026-04-16T12:55:00Z
2
value 0.2051
scoring_system epss
scoring_elements 0.95558
published_at 2026-04-13T12:55:00Z
3
value 0.2051
scoring_system epss
scoring_elements 0.95557
published_at 2026-04-12T12:55:00Z
4
value 0.2051
scoring_system epss
scoring_elements 0.95555
published_at 2026-04-11T12:55:00Z
5
value 0.2051
scoring_system epss
scoring_elements 0.95551
published_at 2026-04-09T12:55:00Z
6
value 0.2051
scoring_system epss
scoring_elements 0.95541
published_at 2026-04-07T12:55:00Z
7
value 0.2051
scoring_system epss
scoring_elements 0.95538
published_at 2026-04-04T12:55:00Z
8
value 0.2051
scoring_system epss
scoring_elements 0.95532
published_at 2026-04-02T12:55:00Z
9
value 0.2051
scoring_system epss
scoring_elements 0.95548
published_at 2026-04-08T12:55:00Z
10
value 0.20519
scoring_system epss
scoring_elements 0.95573
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-22968
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22968
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22968
3
reference_url https://github.com/spring-projects/spring-framework
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework
4
reference_url https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea
5
reference_url https://github.com/spring-projects/spring-framework/commit/a7cf19cec5ebd270f97a194d749e2d5701ad2ab7
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/a7cf19cec5ebd270f97a194d749e2d5701ad2ab7
6
reference_url https://security.netapp.com/advisory/ntap-20220602-0004
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20220602-0004
7
reference_url https://security.netapp.com/advisory/ntap-20220602-0004/
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20220602-0004/
8
reference_url https://www.oracle.com/security-alerts/cpujul2022.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpujul2022.html
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2075441
reference_id 2075441
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2075441
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-22968
reference_id CVE-2022-22968
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-22968
11
reference_url https://tanzu.vmware.com/security/cve-2022-22968
reference_id CVE-2022-22968
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://tanzu.vmware.com/security/cve-2022-22968
12
reference_url https://github.com/advisories/GHSA-g5mm-vmx4-3rg7
reference_id GHSA-g5mm-vmx4-3rg7
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-g5mm-vmx4-3rg7
13
reference_url https://access.redhat.com/errata/RHSA-2022:5101
reference_id RHSA-2022:5101
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:5101
14
reference_url https://access.redhat.com/errata/RHSA-2022:5532
reference_id RHSA-2022:5532
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:5532
fixed_packages
0
url pkg:maven/org.springframework/spring-core@5.2.21
purl pkg:maven/org.springframework/spring-core@5.2.21
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.2.21
1
url pkg:maven/org.springframework/spring-core@5.2.21.RELEASE
purl pkg:maven/org.springframework/spring-core@5.2.21.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-k17s-ttg2-ubgj
2
vulnerability VCID-w6br-v2gm-j7gr
3
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.2.21.RELEASE
2
url pkg:maven/org.springframework/spring-core@5.3.19
purl pkg:maven/org.springframework/spring-core@5.3.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-k17s-ttg2-ubgj
2
vulnerability VCID-k2en-h5n1-r7gr
3
vulnerability VCID-w6br-v2gm-j7gr
4
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.3.19
aliases CVE-2022-22968, GHSA-g5mm-vmx4-3rg7
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-c74k-e1me-pfb2
3
url VCID-cyjt-4vjn-mbc7
vulnerability_id VCID-cyjt-4vjn-mbc7
summary Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework.boot:spring-boot-starter-webflux.
references
0
reference_url http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
1
reference_url http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
2
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22965.json
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22965.json
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-22965
reference_id
reference_type
scores
0
value 0.94428
scoring_system epss
scoring_elements 0.99984
published_at 2026-04-04T12:55:00Z
1
value 0.94428
scoring_system epss
scoring_elements 0.99983
published_at 2026-04-18T12:55:00Z
2
value 0.94428
scoring_system epss
scoring_elements 0.99982
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-22965
4
reference_url https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965
6
reference_url https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12
7
reference_url https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6
8
reference_url https://github.com/spring-projects/spring-framework
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework
9
reference_url https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15
10
reference_url https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE
11
reference_url https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18
12
reference_url https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
13
reference_url https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
14
reference_url https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#suggested-workarounds
reference_id
reference_type
scores
url https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#suggested-workarounds
15
reference_url https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
16
reference_url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965
17
reference_url https://www.kb.cert.org/vuls/id/970766
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.kb.cert.org/vuls/id/970766
18
reference_url https://www.oracle.com/security-alerts/cpuapr2022.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url https://www.oracle.com/security-alerts/cpuapr2022.html
19
reference_url https://www.oracle.com/security-alerts/cpujul2022.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url https://www.oracle.com/security-alerts/cpujul2022.html
20
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2070348
reference_id 2070348
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2070348
21
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-22965
reference_id CVE-2022-22965
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-22965
22
reference_url https://tanzu.vmware.com/security/cve-2022-22965
reference_id CVE-2022-22965
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url https://tanzu.vmware.com/security/cve-2022-22965
23
reference_url https://github.com/advisories/GHSA-36p3-wjmg-h94x
reference_id GHSA-36p3-wjmg-h94x
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-36p3-wjmg-h94x
24
reference_url https://access.redhat.com/errata/RHSA-2022:1306
reference_id RHSA-2022:1306
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:1306
25
reference_url https://access.redhat.com/errata/RHSA-2022:1333
reference_id RHSA-2022:1333
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:1333
26
reference_url https://access.redhat.com/errata/RHSA-2022:1360
reference_id RHSA-2022:1360
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:1360
27
reference_url https://access.redhat.com/errata/RHSA-2022:1378
reference_id RHSA-2022:1378
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:1378
28
reference_url https://access.redhat.com/errata/RHSA-2022:1379
reference_id RHSA-2022:1379
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:1379
29
reference_url https://access.redhat.com/errata/RHSA-2022:1626
reference_id RHSA-2022:1626
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:1626
30
reference_url https://access.redhat.com/errata/RHSA-2022:1627
reference_id RHSA-2022:1627
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:1627
31
reference_url https://usn.ubuntu.com/7165-1/
reference_id USN-7165-1
reference_type
scores
url https://usn.ubuntu.com/7165-1/
fixed_packages
0
url pkg:maven/org.springframework/spring-core@5.2.20
purl pkg:maven/org.springframework/spring-core@5.2.20
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.2.20
1
url pkg:maven/org.springframework/spring-core@5.2.20.RELEASE
purl pkg:maven/org.springframework/spring-core@5.2.20.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-k17s-ttg2-ubgj
3
vulnerability VCID-w6br-v2gm-j7gr
4
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.2.20.RELEASE
2
url pkg:maven/org.springframework/spring-core@5.3.18
purl pkg:maven/org.springframework/spring-core@5.3.18
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-k17s-ttg2-ubgj
3
vulnerability VCID-k2en-h5n1-r7gr
4
vulnerability VCID-w6br-v2gm-j7gr
5
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.3.18
aliases CVE-2022-22965, GHSA-36p3-wjmg-h94x, GMS-2022-558, GMS-2022-559, GMS-2022-560, GMS-2022-561
risk_score 10.0
exploitability 2.0
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cyjt-4vjn-mbc7
4
url VCID-dfs4-emmn-f3eb
vulnerability_id VCID-dfs4-emmn-f3eb
summary Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-5007.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-5007.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-5007
reference_id
reference_type
scores
0
value 0.00155
scoring_system epss
scoring_elements 0.36232
published_at 2026-04-12T12:55:00Z
1
value 0.00155
scoring_system epss
scoring_elements 0.36183
published_at 2026-04-21T12:55:00Z
2
value 0.00155
scoring_system epss
scoring_elements 0.36235
published_at 2026-04-18T12:55:00Z
3
value 0.00155
scoring_system epss
scoring_elements 0.3625
published_at 2026-04-16T12:55:00Z
4
value 0.00155
scoring_system epss
scoring_elements 0.36207
published_at 2026-04-13T12:55:00Z
5
value 0.00155
scoring_system epss
scoring_elements 0.36133
published_at 2026-04-01T12:55:00Z
6
value 0.00155
scoring_system epss
scoring_elements 0.36328
published_at 2026-04-02T12:55:00Z
7
value 0.00155
scoring_system epss
scoring_elements 0.3636
published_at 2026-04-04T12:55:00Z
8
value 0.00155
scoring_system epss
scoring_elements 0.36196
published_at 2026-04-07T12:55:00Z
9
value 0.00155
scoring_system epss
scoring_elements 0.36245
published_at 2026-04-08T12:55:00Z
10
value 0.00155
scoring_system epss
scoring_elements 0.36264
published_at 2026-04-09T12:55:00Z
11
value 0.00155
scoring_system epss
scoring_elements 0.36269
published_at 2026-04-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-5007
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5007
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5007
3
reference_url https://github.com/advisories/GHSA-8crv-49fr-2h6j
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-8crv-49fr-2h6j
4
reference_url https://github.com/spring-projects/spring-framework/commit/a30ab30e4e9ae021fdda04e9abfc228476b846b5
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/a30ab30e4e9ae021fdda04e9abfc228476b846b5
5
reference_url https://github.com/spring-projects/spring-security/commit/e4c13e3c0ee7f06f59d3b43ca6734215ad7d8974
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-security/commit/e4c13e3c0ee7f06f59d3b43ca6734215ad7d8974
6
reference_url https://github.com/spring-projects/spring-security/issues/3964
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-security/issues/3964
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-5007
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-5007
8
reference_url https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
9
reference_url http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
10
reference_url http://www.securityfocus.com/bid/91687
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/91687
11
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1353902
reference_id 1353902
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1353902
12
reference_url https://pivotal.io/security/cve-2016-5007
reference_id CVE-2016-5007
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://pivotal.io/security/cve-2016-5007
fixed_packages
0
url pkg:maven/org.springframework/spring-core@4.3.1
purl pkg:maven/org.springframework/spring-core@4.3.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.3.1
1
url pkg:maven/org.springframework/spring-core@4.3.1.RELEASE
purl pkg:maven/org.springframework/spring-core@4.3.1.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3rev-eg6f-tkb7
1
vulnerability VCID-6ysx-5wcw-f7b5
2
vulnerability VCID-c74k-e1me-pfb2
3
vulnerability VCID-cyjt-4vjn-mbc7
4
vulnerability VCID-j3wr-npbv-8qcw
5
vulnerability VCID-k17s-ttg2-ubgj
6
vulnerability VCID-pb7f-yasx-17ag
7
vulnerability VCID-qpxj-fzta-v7bs
8
vulnerability VCID-w6br-v2gm-j7gr
9
vulnerability VCID-y3uz-etva-sufh
10
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.3.1.RELEASE
aliases CVE-2016-5007, GHSA-8crv-49fr-2h6j
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dfs4-emmn-f3eb
5
url VCID-f3g5-hamr-6yar
vulnerability_id VCID-f3g5-hamr-6yar
summary 
Insufficient Entropy in PRNG
Spring Security contain an insecure randomness vulnerability when using `SecureRandomFactoryBean#setSeed` to configure a `SecureRandom` instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-3795.json
reference_id
reference_type
scores
0
value 3.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-3795.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-3795
reference_id
reference_type
scores
0
value 0.00548
scoring_system epss
scoring_elements 0.67939
published_at 2026-04-21T12:55:00Z
1
value 0.00548
scoring_system epss
scoring_elements 0.67869
published_at 2026-04-07T12:55:00Z
2
value 0.00548
scoring_system epss
scoring_elements 0.67957
published_at 2026-04-11T12:55:00Z
3
value 0.00548
scoring_system epss
scoring_elements 0.67933
published_at 2026-04-09T12:55:00Z
4
value 0.00548
scoring_system epss
scoring_elements 0.6787
published_at 2026-04-02T12:55:00Z
5
value 0.00548
scoring_system epss
scoring_elements 0.67888
published_at 2026-04-04T12:55:00Z
6
value 0.00548
scoring_system epss
scoring_elements 0.6792
published_at 2026-04-08T12:55:00Z
7
value 0.00548
scoring_system epss
scoring_elements 0.67959
published_at 2026-04-18T12:55:00Z
8
value 0.00548
scoring_system epss
scoring_elements 0.67945
published_at 2026-04-16T12:55:00Z
9
value 0.00548
scoring_system epss
scoring_elements 0.67908
published_at 2026-04-13T12:55:00Z
10
value 0.00548
scoring_system epss
scoring_elements 0.67944
published_at 2026-04-12T12:55:00Z
11
value 0.00548
scoring_system epss
scoring_elements 0.67846
published_at 2026-04-01T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-3795
2
reference_url https://github.com/advisories/GHSA-v2r2-7qm7-jj6v
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-v2r2-7qm7-jj6v
3
reference_url https://lists.debian.org/debian-lts-announce/2019/05/msg00026.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2019/05/msg00026.html
4
reference_url http://www.securityfocus.com/bid/107802
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/107802
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1696616
reference_id 1696616
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1696616
6
reference_url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
reference_id cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
reference_type
scores
url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
7
reference_url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
reference_id cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
reference_type
scores
url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-3795
reference_id CVE-2019-3795
reference_type
scores
0
value 5.0
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:N/C:P/I:N/A:N
1
value 3.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N
2
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-3795
9
reference_url https://pivotal.io/security/cve-2019-3795
reference_id CVE-2019-3795
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://pivotal.io/security/cve-2019-3795
fixed_packages
0
url pkg:maven/org.springframework/spring-core@4.3.0.RELEASE
purl pkg:maven/org.springframework/spring-core@4.3.0.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3rev-eg6f-tkb7
1
vulnerability VCID-6ysx-5wcw-f7b5
2
vulnerability VCID-c74k-e1me-pfb2
3
vulnerability VCID-cyjt-4vjn-mbc7
4
vulnerability VCID-dfs4-emmn-f3eb
5
vulnerability VCID-j3wr-npbv-8qcw
6
vulnerability VCID-k17s-ttg2-ubgj
7
vulnerability VCID-mqnn-spsw-8fg5
8
vulnerability VCID-pb7f-yasx-17ag
9
vulnerability VCID-qpxj-fzta-v7bs
10
vulnerability VCID-w6br-v2gm-j7gr
11
vulnerability VCID-y3uz-etva-sufh
12
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.3.0.RELEASE
1
url pkg:maven/org.springframework/spring-core@5.0.12.RELEASE
purl pkg:maven/org.springframework/spring-core@5.0.12.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cyjt-4vjn-mbc7
3
vulnerability VCID-k17s-ttg2-ubgj
4
vulnerability VCID-w6br-v2gm-j7gr
5
vulnerability VCID-y3uz-etva-sufh
6
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.0.12.RELEASE
2
url pkg:maven/org.springframework/spring-core@5.0.13.RELEASE
purl pkg:maven/org.springframework/spring-core@5.0.13.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cyjt-4vjn-mbc7
3
vulnerability VCID-k17s-ttg2-ubgj
4
vulnerability VCID-w6br-v2gm-j7gr
5
vulnerability VCID-y3uz-etva-sufh
6
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.0.13.RELEASE
3
url pkg:maven/org.springframework/spring-core@5.1.5.RELEASE
purl pkg:maven/org.springframework/spring-core@5.1.5.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cyjt-4vjn-mbc7
3
vulnerability VCID-k17s-ttg2-ubgj
4
vulnerability VCID-w6br-v2gm-j7gr
5
vulnerability VCID-y3uz-etva-sufh
6
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.1.5.RELEASE
4
url pkg:maven/org.springframework/spring-core@5.1.6.RELEASE
purl pkg:maven/org.springframework/spring-core@5.1.6.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cyjt-4vjn-mbc7
3
vulnerability VCID-k17s-ttg2-ubgj
4
vulnerability VCID-w6br-v2gm-j7gr
5
vulnerability VCID-y3uz-etva-sufh
6
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.1.6.RELEASE
aliases CVE-2019-3795, GHSA-v2r2-7qm7-jj6v
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-f3g5-hamr-6yar
6
url VCID-j3wr-npbv-8qcw
vulnerability_id VCID-j3wr-npbv-8qcw
summary An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.
references
0
reference_url https://access.redhat.com/errata/RHSA-2017:3115
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2017:3115
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-9878.json
reference_id
reference_type
scores
0
value 5.6
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-9878.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-9878
reference_id
reference_type
scores
0
value 0.03689
scoring_system epss
scoring_elements 0.87936
published_at 2026-04-12T12:55:00Z
1
value 0.03689
scoring_system epss
scoring_elements 0.87943
published_at 2026-04-11T12:55:00Z
2
value 0.04927
scoring_system epss
scoring_elements 0.8958
published_at 2026-04-01T12:55:00Z
3
value 0.04927
scoring_system epss
scoring_elements 0.89619
published_at 2026-04-09T12:55:00Z
4
value 0.04927
scoring_system epss
scoring_elements 0.89613
published_at 2026-04-08T12:55:00Z
5
value 0.04927
scoring_system epss
scoring_elements 0.89597
published_at 2026-04-07T12:55:00Z
6
value 0.04927
scoring_system epss
scoring_elements 0.89596
published_at 2026-04-04T12:55:00Z
7
value 0.04927
scoring_system epss
scoring_elements 0.89583
published_at 2026-04-02T12:55:00Z
8
value 0.05056
scoring_system epss
scoring_elements 0.89794
published_at 2026-04-18T12:55:00Z
9
value 0.05056
scoring_system epss
scoring_elements 0.89788
published_at 2026-04-21T12:55:00Z
10
value 0.05629
scoring_system epss
scoring_elements 0.90343
published_at 2026-04-13T12:55:00Z
11
value 0.05629
scoring_system epss
scoring_elements 0.90359
published_at 2026-04-16T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-9878
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9878
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9878
4
reference_url https://github.com/spring-projects/spring-framework
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework
5
reference_url https://github.com/spring-projects/spring-framework/commit/43bf008fbcd0d7945e2fcd5e30039bc4d74c7a98
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/43bf008fbcd0d7945e2fcd5e30039bc4d74c7a98
6
reference_url https://github.com/spring-projects/spring-framework/commit/a7dc48534ea501525f11369d369178a60c2f47d0
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/a7dc48534ea501525f11369d369178a60c2f47d0
7
reference_url https://github.com/spring-projects/spring-framework/commit/e2d6e709c3c65a4951eb096843ee75d5200cfcad
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/e2d6e709c3c65a4951eb096843ee75d5200cfcad
8
reference_url https://github.com/spring-projects/spring-framework/issues/19513
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/issues/19513
9
reference_url https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
10
reference_url https://security.netapp.com/advisory/ntap-20180419-0002
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20180419-0002
11
reference_url https://security.netapp.com/advisory/ntap-20180419-0002/
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20180419-0002/
12
reference_url https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
13
reference_url http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
14
reference_url http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
15
reference_url http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
16
reference_url http://www.securityfocus.com/bid/95072
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/95072
17
reference_url http://www.securitytracker.com/id/1040698
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.securitytracker.com/id/1040698
18
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1408164
reference_id 1408164
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1408164
19
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=849167
reference_id 849167
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=849167
20
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-9878
reference_id CVE-2016-9878
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-9878
21
reference_url https://pivotal.io/security/cve-2016-9878
reference_id CVE-2016-9878
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://pivotal.io/security/cve-2016-9878
22
reference_url https://github.com/advisories/GHSA-2m8h-fgr8-2q9w
reference_id GHSA-2m8h-fgr8-2q9w
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-2m8h-fgr8-2q9w
23
reference_url https://usn.ubuntu.com/USN-4774-1/
reference_id USN-USN-4774-1
reference_type
scores
url https://usn.ubuntu.com/USN-4774-1/
fixed_packages
0
url pkg:maven/org.springframework/spring-core@4.2.9
purl pkg:maven/org.springframework/spring-core@4.2.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-y3uz-etva-sufh
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.2.9
1
url pkg:maven/org.springframework/spring-core@4.2.9.RELEASE
purl pkg:maven/org.springframework/spring-core@4.2.9.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3rev-eg6f-tkb7
1
vulnerability VCID-6ysx-5wcw-f7b5
2
vulnerability VCID-c74k-e1me-pfb2
3
vulnerability VCID-cyjt-4vjn-mbc7
4
vulnerability VCID-dfs4-emmn-f3eb
5
vulnerability VCID-f3g5-hamr-6yar
6
vulnerability VCID-k17s-ttg2-ubgj
7
vulnerability VCID-pb7f-yasx-17ag
8
vulnerability VCID-pz7c-p4ze-kfhc
9
vulnerability VCID-w6br-v2gm-j7gr
10
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.2.9.RELEASE
2
url pkg:maven/org.springframework/spring-core@4.3.5
purl pkg:maven/org.springframework/spring-core@4.3.5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.3.5
3
url pkg:maven/org.springframework/spring-core@4.3.5.RELEASE
purl pkg:maven/org.springframework/spring-core@4.3.5.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3rev-eg6f-tkb7
1
vulnerability VCID-6ysx-5wcw-f7b5
2
vulnerability VCID-c74k-e1me-pfb2
3
vulnerability VCID-cyjt-4vjn-mbc7
4
vulnerability VCID-k17s-ttg2-ubgj
5
vulnerability VCID-pb7f-yasx-17ag
6
vulnerability VCID-qpxj-fzta-v7bs
7
vulnerability VCID-w6br-v2gm-j7gr
8
vulnerability VCID-y3uz-etva-sufh
9
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.3.5.RELEASE
aliases CVE-2016-9878, GHSA-2m8h-fgr8-2q9w
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-j3wr-npbv-8qcw
7
url VCID-k17s-ttg2-ubgj
vulnerability_id VCID-k17s-ttg2-ubgj
summary 
Allocation of Resources Without Limits or Throttling
In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22971.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22971.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-22971
reference_id
reference_type
scores
0
value 0.00338
scoring_system epss
scoring_elements 0.56619
published_at 2026-04-21T12:55:00Z
1
value 0.00338
scoring_system epss
scoring_elements 0.56647
published_at 2026-04-18T12:55:00Z
2
value 0.00338
scoring_system epss
scoring_elements 0.56648
published_at 2026-04-16T12:55:00Z
3
value 0.00338
scoring_system epss
scoring_elements 0.56617
published_at 2026-04-13T12:55:00Z
4
value 0.00338
scoring_system epss
scoring_elements 0.56639
published_at 2026-04-12T12:55:00Z
5
value 0.00338
scoring_system epss
scoring_elements 0.56663
published_at 2026-04-11T12:55:00Z
6
value 0.00338
scoring_system epss
scoring_elements 0.56669
published_at 2026-04-09T12:55:00Z
7
value 0.00386
scoring_system epss
scoring_elements 0.59793
published_at 2026-04-08T12:55:00Z
8
value 0.00386
scoring_system epss
scoring_elements 0.59742
published_at 2026-04-07T12:55:00Z
9
value 0.00386
scoring_system epss
scoring_elements 0.59772
published_at 2026-04-04T12:55:00Z
10
value 0.00386
scoring_system epss
scoring_elements 0.59748
published_at 2026-04-02T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-22971
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22971
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22971
3
reference_url https://github.com/spring-projects/spring-framework
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework
4
reference_url https://github.com/spring-projects/spring-framework/commit/159a99bbafdd6c01871228113d7042c3f83f360f
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/159a99bbafdd6c01871228113d7042c3f83f360f
5
reference_url https://github.com/spring-projects/spring-framework/commit/dc2947c52df18d5e99cad03383f7d6ba13d031fd
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/dc2947c52df18d5e99cad03383f7d6ba13d031fd
6
reference_url https://security.netapp.com/advisory/ntap-20220616-0003
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20220616-0003
7
reference_url https://security.netapp.com/advisory/ntap-20220616-0003/
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20220616-0003/
8
reference_url https://www.oracle.com/security-alerts/cpujul2022.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpujul2022.html
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2087274
reference_id 2087274
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2087274
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-22971
reference_id CVE-2022-22971
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-22971
11
reference_url https://tanzu.vmware.com/security/cve-2022-22971
reference_id CVE-2022-22971
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://tanzu.vmware.com/security/cve-2022-22971
12
reference_url https://github.com/advisories/GHSA-rqph-vqwm-22vc
reference_id GHSA-rqph-vqwm-22vc
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-rqph-vqwm-22vc
13
reference_url https://access.redhat.com/errata/RHSA-2022:5532
reference_id RHSA-2022:5532
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:5532
14
reference_url https://access.redhat.com/errata/RHSA-2023:1661
reference_id RHSA-2023:1661
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:1661
15
reference_url https://access.redhat.com/errata/RHSA-2023:3185
reference_id RHSA-2023:3185
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:3185
fixed_packages
0
url pkg:maven/org.springframework/spring-core@5.2.22.RELEASE
purl pkg:maven/org.springframework/spring-core@5.2.22.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.2.22.RELEASE
1
url pkg:maven/org.springframework/spring-core@5.3.20
purl pkg:maven/org.springframework/spring-core@5.3.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-k2en-h5n1-r7gr
2
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.3.20
aliases CVE-2022-22971, GHSA-rqph-vqwm-22vc
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-k17s-ttg2-ubgj
8
url VCID-pb7f-yasx-17ag
vulnerability_id VCID-pb7f-yasx-17ag
summary Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.
references
0
reference_url https://access.redhat.com/errata/RHSA-2018:1320
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2018:1320
1
reference_url https://access.redhat.com/errata/RHSA-2018:2669
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2018:2669
2
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1272.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1272.json
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-1272
reference_id
reference_type
scores
0
value 0.02166
scoring_system epss
scoring_elements 0.84307
published_at 2026-04-12T12:55:00Z
1
value 0.02166
scoring_system epss
scoring_elements 0.84313
published_at 2026-04-11T12:55:00Z
2
value 0.02166
scoring_system epss
scoring_elements 0.84295
published_at 2026-04-09T12:55:00Z
3
value 0.02166
scoring_system epss
scoring_elements 0.84268
published_at 2026-04-07T12:55:00Z
4
value 0.02166
scoring_system epss
scoring_elements 0.84266
published_at 2026-04-04T12:55:00Z
5
value 0.02166
scoring_system epss
scoring_elements 0.8429
published_at 2026-04-08T12:55:00Z
6
value 0.02166
scoring_system epss
scoring_elements 0.84329
published_at 2026-04-21T12:55:00Z
7
value 0.02166
scoring_system epss
scoring_elements 0.84327
published_at 2026-04-18T12:55:00Z
8
value 0.02166
scoring_system epss
scoring_elements 0.84326
published_at 2026-04-16T12:55:00Z
9
value 0.02166
scoring_system epss
scoring_elements 0.84304
published_at 2026-04-13T12:55:00Z
10
value 0.02166
scoring_system epss
scoring_elements 0.84247
published_at 2026-04-02T12:55:00Z
11
value 0.02166
scoring_system epss
scoring_elements 0.84235
published_at 2026-04-01T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-1272
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1272
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1272
5
reference_url https://exchange.xforce.ibmcloud.com/vulnerabilities/141286
reference_id
reference_type
scores
url https://exchange.xforce.ibmcloud.com/vulnerabilities/141286
6
reference_url https://github.com/spring-projects/spring-framework/commit/ab2410c754b67902f002bfcc0c3895bd7772d39
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/ab2410c754b67902f002bfcc0c3895bd7772d39
7
reference_url https://github.com/spring-projects/spring-framework/commit/e02ff3a0da50744b0980d5d665fd242eedea767
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/e02ff3a0da50744b0980d5d665fd242eedea767
8
reference_url https://www.oracle.com/security-alerts/cpujul2020.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpujul2020.html
9
reference_url https://www.oracle.com/security-alerts/cpuoct2021.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpuoct2021.html
10
reference_url https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
11
reference_url https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
12
reference_url http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
13
reference_url http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
14
reference_url http://www.securityfocus.com/bid/103697
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/103697
15
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1564408
reference_id 1564408
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1564408
16
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895114
reference_id 895114
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895114
17
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-1272
reference_id CVE-2018-1272
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-1272
18
reference_url https://pivotal.io/security/cve-2018-1272
reference_id CVE-2018-1272
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://pivotal.io/security/cve-2018-1272
19
reference_url https://github.com/advisories/GHSA-4487-x383-qpph
reference_id GHSA-4487-x383-qpph
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-4487-x383-qpph
fixed_packages
0
url pkg:maven/org.springframework/spring-core@4.3.15
purl pkg:maven/org.springframework/spring-core@4.3.15
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.3.15
1
url pkg:maven/org.springframework/spring-core@4.3.15.RELEASE
purl pkg:maven/org.springframework/spring-core@4.3.15.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3rev-eg6f-tkb7
1
vulnerability VCID-6ysx-5wcw-f7b5
2
vulnerability VCID-c74k-e1me-pfb2
3
vulnerability VCID-cyjt-4vjn-mbc7
4
vulnerability VCID-k17s-ttg2-ubgj
5
vulnerability VCID-w6br-v2gm-j7gr
6
vulnerability VCID-y3uz-etva-sufh
7
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.3.15.RELEASE
2
url pkg:maven/org.springframework/spring-core@5.0.5
purl pkg:maven/org.springframework/spring-core@5.0.5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.0.5
3
url pkg:maven/org.springframework/spring-core@5.0.5.RELEASE
purl pkg:maven/org.springframework/spring-core@5.0.5.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-859k-nee7-e7h8
2
vulnerability VCID-c74k-e1me-pfb2
3
vulnerability VCID-cyjt-4vjn-mbc7
4
vulnerability VCID-f3g5-hamr-6yar
5
vulnerability VCID-k17s-ttg2-ubgj
6
vulnerability VCID-w6br-v2gm-j7gr
7
vulnerability VCID-y3uz-etva-sufh
8
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.0.5.RELEASE
aliases CVE-2018-1272, GHSA-4487-x383-qpph
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-pb7f-yasx-17ag
9
url VCID-pht6-8af8-b3f2
vulnerability_id VCID-pht6-8af8-b3f2
summary Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-15756.json
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-15756.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-15756
reference_id
reference_type
scores
0
value 0.18104
scoring_system epss
scoring_elements 0.95192
published_at 2026-04-21T12:55:00Z
1
value 0.18104
scoring_system epss
scoring_elements 0.95191
published_at 2026-04-18T12:55:00Z
2
value 0.18104
scoring_system epss
scoring_elements 0.95187
published_at 2026-04-16T12:55:00Z
3
value 0.18104
scoring_system epss
scoring_elements 0.95179
published_at 2026-04-13T12:55:00Z
4
value 0.18104
scoring_system epss
scoring_elements 0.95177
published_at 2026-04-12T12:55:00Z
5
value 0.18104
scoring_system epss
scoring_elements 0.95176
published_at 2026-04-11T12:55:00Z
6
value 0.18104
scoring_system epss
scoring_elements 0.95166
published_at 2026-04-08T12:55:00Z
7
value 0.18104
scoring_system epss
scoring_elements 0.95158
published_at 2026-04-07T12:55:00Z
8
value 0.18104
scoring_system epss
scoring_elements 0.95156
published_at 2026-04-04T12:55:00Z
9
value 0.18104
scoring_system epss
scoring_elements 0.95154
published_at 2026-04-02T12:55:00Z
10
value 0.18104
scoring_system epss
scoring_elements 0.95144
published_at 2026-04-01T12:55:00Z
11
value 0.18104
scoring_system epss
scoring_elements 0.9517
published_at 2026-04-09T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-15756
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15756
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15756
3
reference_url https://github.com/spring-projects/spring-framework
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework
4
reference_url https://github.com/spring-projects/spring-framework/commit/044772641d12b9281185f6cf50f8485b8747132
reference_id
reference_type
scores
url https://github.com/spring-projects/spring-framework/commit/044772641d12b9281185f6cf50f8485b8747132
5
reference_url https://github.com/spring-projects/spring-framework/commit/423aa28ed584b4ff6e5bad218c09beef5e91951
reference_id
reference_type
scores
url https://github.com/spring-projects/spring-framework/commit/423aa28ed584b4ff6e5bad218c09beef5e91951
6
reference_url https://github.com/spring-projects/spring-framework/commit/c8e320019ffe7298fc4cbeeb194b2bfd6389b6d
reference_id
reference_type
scores
url https://github.com/spring-projects/spring-framework/commit/c8e320019ffe7298fc4cbeeb194b2bfd6389b6d
7
reference_url https://lists.apache.org/thread.html/339fd112517e4873695b5115b96acdddbfc8f83b10598528d37c7d12@%3Cissues.activemq.apache.org%3E
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/339fd112517e4873695b5115b96acdddbfc8f83b10598528d37c7d12@%3Cissues.activemq.apache.org%3E
8
reference_url https://lists.apache.org/thread.html/77886fec378ee6064debb1efb6b464a4a0173b2ff0d151ed86d3a228@%3Cissues.activemq.apache.org%3E
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/77886fec378ee6064debb1efb6b464a4a0173b2ff0d151ed86d3a228@%3Cissues.activemq.apache.org%3E
9
reference_url https://lists.apache.org/thread.html/7b156ee50ba3ecce87b33c06bf7a749d84ffee55e69bfb5eca88fcc3@%3Cissues.activemq.apache.org%3E
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/7b156ee50ba3ecce87b33c06bf7a749d84ffee55e69bfb5eca88fcc3@%3Cissues.activemq.apache.org%3E
10
reference_url https://lists.apache.org/thread.html/8a1fe70534fc52ff5c9db5ac29c55657f802cbefd7e9d9850c7052bd@%3Cissues.activemq.apache.org%3E
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/8a1fe70534fc52ff5c9db5ac29c55657f802cbefd7e9d9850c7052bd@%3Cissues.activemq.apache.org%3E
11
reference_url https://lists.apache.org/thread.html/a3071e11c6fbd593022074ec1b4693f6d948c2b02cfa4a5d854aed68@%3Cissues.activemq.apache.org%3E
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/a3071e11c6fbd593022074ec1b4693f6d948c2b02cfa4a5d854aed68@%3Cissues.activemq.apache.org%3E
12
reference_url https://lists.apache.org/thread.html/bb354962cb51fff65740d5fb1bc2aac56af577c06244b57c36f98e4d@%3Cissues.activemq.apache.org%3E
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/bb354962cb51fff65740d5fb1bc2aac56af577c06244b57c36f98e4d@%3Cissues.activemq.apache.org%3E
13
reference_url https://lists.apache.org/thread.html/d6a84f52db89804b0ad965f3ea2b24bb880edee29107a1c5069cc3dd@%3Cissues.activemq.apache.org%3E
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/d6a84f52db89804b0ad965f3ea2b24bb880edee29107a1c5069cc3dd@%3Cissues.activemq.apache.org%3E
14
reference_url https://lists.apache.org/thread.html/efaa52b0aa67aae7cbd9e6ef96945387e422d7ce0e65434570a37b1d@%3Cissues.activemq.apache.org%3E
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/efaa52b0aa67aae7cbd9e6ef96945387e422d7ce0e65434570a37b1d@%3Cissues.activemq.apache.org%3E
15
reference_url https://lists.apache.org/thread.html/f8905507a2c94af6b08b72d7be0c4b8c6660e585f00abfafeccc86bc@%3Cissues.activemq.apache.org%3E
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/f8905507a2c94af6b08b72d7be0c4b8c6660e585f00abfafeccc86bc@%3Cissues.activemq.apache.org%3E
16
reference_url https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
17
reference_url https://www.oracle.com/security-alerts/cpuapr2020.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpuapr2020.html
18
reference_url https://www.oracle.com/security-alerts/cpujan2020.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpujan2020.html
19
reference_url https://www.oracle.com/security-alerts/cpujan2021.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpujan2021.html
20
reference_url https://www.oracle.com/security-alerts/cpujul2020.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpujul2020.html
21
reference_url https://www.oracle.com//security-alerts/cpujul2021.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com//security-alerts/cpujul2021.html
22
reference_url https://www.oracle.com/security-alerts/cpuoct2021.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpuoct2021.html
23
reference_url https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
24
reference_url https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
25
reference_url https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
26
reference_url http://www.securityfocus.com/bid/105703
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/105703
27
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1643043
reference_id 1643043
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1643043
28
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=911786
reference_id 911786
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=911786
29
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-15756
reference_id CVE-2018-15756
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-15756
30
reference_url https://pivotal.io/security/cve-2018-15756
reference_id CVE-2018-15756
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://pivotal.io/security/cve-2018-15756
31
reference_url https://github.com/advisories/GHSA-ffvq-7w96-97p7
reference_id GHSA-ffvq-7w96-97p7
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-ffvq-7w96-97p7
32
reference_url https://access.redhat.com/errata/RHSA-2020:0983
reference_id RHSA-2020:0983
reference_type
scores
url https://access.redhat.com/errata/RHSA-2020:0983
33
reference_url https://access.redhat.com/errata/RHSA-2020:3133
reference_id RHSA-2020:3133
reference_type
scores
url https://access.redhat.com/errata/RHSA-2020:3133
fixed_packages
0
url pkg:maven/org.springframework/spring-core@4.3.20
purl pkg:maven/org.springframework/spring-core@4.3.20
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.3.20
1
url pkg:maven/org.springframework/spring-core@4.3.20.RELEASE
purl pkg:maven/org.springframework/spring-core@4.3.20.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cyjt-4vjn-mbc7
3
vulnerability VCID-k17s-ttg2-ubgj
4
vulnerability VCID-w6br-v2gm-j7gr
5
vulnerability VCID-y3uz-etva-sufh
6
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.3.20.RELEASE
2
url pkg:maven/org.springframework/spring-core@5.0.10.RELEASE
purl pkg:maven/org.springframework/spring-core@5.0.10.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cyjt-4vjn-mbc7
3
vulnerability VCID-f3g5-hamr-6yar
4
vulnerability VCID-k17s-ttg2-ubgj
5
vulnerability VCID-w6br-v2gm-j7gr
6
vulnerability VCID-y3uz-etva-sufh
7
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.0.10.RELEASE
3
url pkg:maven/org.springframework/spring-core@5.1.1
purl pkg:maven/org.springframework/spring-core@5.1.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.1.1
4
url pkg:maven/org.springframework/spring-core@5.1.1.RELEASE
purl pkg:maven/org.springframework/spring-core@5.1.1.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cyjt-4vjn-mbc7
3
vulnerability VCID-f3g5-hamr-6yar
4
vulnerability VCID-k17s-ttg2-ubgj
5
vulnerability VCID-w6br-v2gm-j7gr
6
vulnerability VCID-y3uz-etva-sufh
7
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.1.1.RELEASE
aliases CVE-2018-15756, GHSA-ffvq-7w96-97p7
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-pht6-8af8-b3f2
10
url VCID-pz7c-p4ze-kfhc
vulnerability_id VCID-pz7c-p4ze-kfhc
summary 
PlaintextPasswordEncoder authenticates encoded passwords that are null
Spring Security supports plain text passwords using `PlaintextPasswordEncoder`. a malicious user (or attacker) can authenticate using a password of `null`.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-11272.json
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-11272.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-11272
reference_id
reference_type
scores
0
value 0.00407
scoring_system epss
scoring_elements 0.61181
published_at 2026-04-21T12:55:00Z
1
value 0.00407
scoring_system epss
scoring_elements 0.6115
published_at 2026-04-08T12:55:00Z
2
value 0.00407
scoring_system epss
scoring_elements 0.61165
published_at 2026-04-09T12:55:00Z
3
value 0.00407
scoring_system epss
scoring_elements 0.61186
published_at 2026-04-11T12:55:00Z
4
value 0.00407
scoring_system epss
scoring_elements 0.61173
published_at 2026-04-12T12:55:00Z
5
value 0.00407
scoring_system epss
scoring_elements 0.61154
published_at 2026-04-13T12:55:00Z
6
value 0.00407
scoring_system epss
scoring_elements 0.61194
published_at 2026-04-16T12:55:00Z
7
value 0.00407
scoring_system epss
scoring_elements 0.612
published_at 2026-04-18T12:55:00Z
8
value 0.00407
scoring_system epss
scoring_elements 0.61031
published_at 2026-04-01T12:55:00Z
9
value 0.00407
scoring_system epss
scoring_elements 0.61108
published_at 2026-04-02T12:55:00Z
10
value 0.00407
scoring_system epss
scoring_elements 0.61136
published_at 2026-04-04T12:55:00Z
11
value 0.00407
scoring_system epss
scoring_elements 0.61102
published_at 2026-04-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-11272
2
reference_url https://lists.debian.org/debian-lts-announce/2019/07/msg00008.html
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2019/07/msg00008.html
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1728993
reference_id 1728993
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1728993
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-11272
reference_id CVE-2019-11272
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-11272
5
reference_url https://pivotal.io/security/cve-2019-11272
reference_id CVE-2019-11272
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://pivotal.io/security/cve-2019-11272
6
reference_url https://github.com/advisories/GHSA-v33x-prhc-gph5
reference_id GHSA-v33x-prhc-gph5
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-v33x-prhc-gph5
7
reference_url https://access.redhat.com/errata/RHSA-2020:0983
reference_id RHSA-2020:0983
reference_type
scores
url https://access.redhat.com/errata/RHSA-2020:0983
fixed_packages
0
url pkg:maven/org.springframework/spring-core@4.3.0.RELEASE
purl pkg:maven/org.springframework/spring-core@4.3.0.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3rev-eg6f-tkb7
1
vulnerability VCID-6ysx-5wcw-f7b5
2
vulnerability VCID-c74k-e1me-pfb2
3
vulnerability VCID-cyjt-4vjn-mbc7
4
vulnerability VCID-dfs4-emmn-f3eb
5
vulnerability VCID-j3wr-npbv-8qcw
6
vulnerability VCID-k17s-ttg2-ubgj
7
vulnerability VCID-mqnn-spsw-8fg5
8
vulnerability VCID-pb7f-yasx-17ag
9
vulnerability VCID-qpxj-fzta-v7bs
10
vulnerability VCID-w6br-v2gm-j7gr
11
vulnerability VCID-y3uz-etva-sufh
12
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.3.0.RELEASE
aliases CVE-2019-11272, GHSA-v33x-prhc-gph5
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-pz7c-p4ze-kfhc
11
url VCID-w6br-v2gm-j7gr
vulnerability_id VCID-w6br-v2gm-j7gr
summary 
Allocation of Resources Without Limits or Throttling
In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, applications that handle file uploads is vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22970.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22970.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-22970
reference_id
reference_type
scores
0
value 0.00164
scoring_system epss
scoring_elements 0.37258
published_at 2026-04-21T12:55:00Z
1
value 0.00164
scoring_system epss
scoring_elements 0.37312
published_at 2026-04-18T12:55:00Z
2
value 0.00164
scoring_system epss
scoring_elements 0.3733
published_at 2026-04-16T12:55:00Z
3
value 0.00164
scoring_system epss
scoring_elements 0.37283
published_at 2026-04-13T12:55:00Z
4
value 0.00164
scoring_system epss
scoring_elements 0.37311
published_at 2026-04-12T12:55:00Z
5
value 0.00164
scoring_system epss
scoring_elements 0.37345
published_at 2026-04-11T12:55:00Z
6
value 0.00164
scoring_system epss
scoring_elements 0.37349
published_at 2026-04-09T12:55:00Z
7
value 0.00187
scoring_system epss
scoring_elements 0.40504
published_at 2026-04-07T12:55:00Z
8
value 0.00187
scoring_system epss
scoring_elements 0.40583
published_at 2026-04-04T12:55:00Z
9
value 0.00187
scoring_system epss
scoring_elements 0.40555
published_at 2026-04-08T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-22970
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22970
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22970
3
reference_url https://github.com/spring-projects/spring-framework
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework
4
reference_url https://github.com/spring-projects/spring-framework/commit/50177b1ad3485bd44239b1756f6c14607476fcf2
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/50177b1ad3485bd44239b1756f6c14607476fcf2
5
reference_url https://github.com/spring-projects/spring-framework/commit/83186b689f11f5e6efe7ccc08fdeb92f66fcd583
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/83186b689f11f5e6efe7ccc08fdeb92f66fcd583
6
reference_url https://security.netapp.com/advisory/ntap-20220616-0006
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20220616-0006
7
reference_url https://security.netapp.com/advisory/ntap-20220616-0006/
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20220616-0006/
8
reference_url https://www.oracle.com/security-alerts/cpujul2022.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpujul2022.html
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2087272
reference_id 2087272
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2087272
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-22970
reference_id CVE-2022-22970
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-22970
11
reference_url https://tanzu.vmware.com/security/cve-2022-22970
reference_id CVE-2022-22970
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://tanzu.vmware.com/security/cve-2022-22970
12
reference_url https://github.com/advisories/GHSA-hh26-6xwr-ggv7
reference_id GHSA-hh26-6xwr-ggv7
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-hh26-6xwr-ggv7
13
reference_url https://access.redhat.com/errata/RHSA-2022:5532
reference_id RHSA-2022:5532
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:5532
14
reference_url https://access.redhat.com/errata/RHSA-2023:1661
reference_id RHSA-2023:1661
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:1661
15
reference_url https://access.redhat.com/errata/RHSA-2023:3185
reference_id RHSA-2023:3185
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:3185
fixed_packages
0
url pkg:maven/org.springframework/spring-core@5.2.22.RELEASE
purl pkg:maven/org.springframework/spring-core@5.2.22.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.2.22.RELEASE
1
url pkg:maven/org.springframework/spring-core@5.3.20
purl pkg:maven/org.springframework/spring-core@5.3.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-k2en-h5n1-r7gr
2
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.3.20
aliases CVE-2022-22970, GHSA-hh26-6xwr-ggv7
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-w6br-v2gm-j7gr
12
url VCID-y3uz-etva-sufh
vulnerability_id VCID-y3uz-etva-sufh
summary 
Improper Input Validation in Spring Framework
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5421.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-5421.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-5421
reference_id
reference_type
scores
0
value 0.63828
scoring_system epss
scoring_elements 0.98431
published_at 2026-04-21T12:55:00Z
1
value 0.63828
scoring_system epss
scoring_elements 0.98432
published_at 2026-04-16T12:55:00Z
2
value 0.63828
scoring_system epss
scoring_elements 0.98427
published_at 2026-04-13T12:55:00Z
3
value 0.63828
scoring_system epss
scoring_elements 0.98424
published_at 2026-04-09T12:55:00Z
4
value 0.63828
scoring_system epss
scoring_elements 0.98423
published_at 2026-04-08T12:55:00Z
5
value 0.63828
scoring_system epss
scoring_elements 0.9842
published_at 2026-04-07T12:55:00Z
6
value 0.63828
scoring_system epss
scoring_elements 0.98417
published_at 2026-04-04T12:55:00Z
7
value 0.63828
scoring_system epss
scoring_elements 0.98414
published_at 2026-04-02T12:55:00Z
8
value 0.63828
scoring_system epss
scoring_elements 0.98412
published_at 2026-04-01T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-5421
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5421
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5421
3
reference_url https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163@%3Ccommits.ambari.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163@%3Ccommits.ambari.apache.org%3E
4
reference_url https://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a@%3Cissues.ambari.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a@%3Cissues.ambari.apache.org%3E
5
reference_url https://lists.apache.org/thread.html/r3589ed0d18edeb79028615080d5a0e8878856436bb91774a3196d9eb@%3Ccommits.pulsar.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r3589ed0d18edeb79028615080d5a0e8878856436bb91774a3196d9eb@%3Ccommits.pulsar.apache.org%3E
6
reference_url https://lists.apache.org/thread.html/r503e64b43a57fd68229cac4a869d1a9a2eac9e75f8719cad3a840211@%3Ccommits.pulsar.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r503e64b43a57fd68229cac4a869d1a9a2eac9e75f8719cad3a840211@%3Ccommits.pulsar.apache.org%3E
7
reference_url https://lists.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5@%3Cissues.ambari.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5@%3Cissues.ambari.apache.org%3E
8
reference_url https://lists.apache.org/thread.html/r7e6a213eea7f04fc6d9e3bd6eb8d68c4df92a22e956e95cb2c482865@%3Cissues.hive.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r7e6a213eea7f04fc6d9e3bd6eb8d68c4df92a22e956e95cb2c482865@%3Cissues.hive.apache.org%3E
9
reference_url https://lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a@%3Cdev.ambari.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a@%3Cdev.ambari.apache.org%3E
10
reference_url https://lists.apache.org/thread.html/r918caad55dcc640a16753b00d8d6acb90b4e36de4b6156d0867246ec@%3Ccommits.pulsar.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r918caad55dcc640a16753b00d8d6acb90b4e36de4b6156d0867246ec@%3Ccommits.pulsar.apache.org%3E
11
reference_url https://lists.apache.org/thread.html/r9f13cccb214495e14648d2c9b8f2c6072fd5219e74502dd35ede81e1@%3Cdev.ambari.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r9f13cccb214495e14648d2c9b8f2c6072fd5219e74502dd35ede81e1@%3Cdev.ambari.apache.org%3E
12
reference_url https://lists.apache.org/thread.html/ra889d95141059c6cbe77dd80249bb488ae53b274b5f3abad09d9511d@%3Cuser.ignite.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/ra889d95141059c6cbe77dd80249bb488ae53b274b5f3abad09d9511d@%3Cuser.ignite.apache.org%3E
13
reference_url https://lists.apache.org/thread.html/raf7ca57033e537e4f9d7df7f192fa6968c1e49409b2348e08d807ccb@%3Cuser.ignite.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/raf7ca57033e537e4f9d7df7f192fa6968c1e49409b2348e08d807ccb@%3Cuser.ignite.apache.org%3E
14
reference_url https://lists.apache.org/thread.html/rb18ed999153ef0f0cb7af03efe0046c42c7242fd77fbd884a75ecfdc@%3Ccommits.pulsar.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/rb18ed999153ef0f0cb7af03efe0046c42c7242fd77fbd884a75ecfdc@%3Ccommits.pulsar.apache.org%3E
15
reference_url https://lists.apache.org/thread.html/rc9efaf6db98bee19db1bc911d0fa442287dac5cb229d4aaa08b6a13d@%3Cissues.hive.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/rc9efaf6db98bee19db1bc911d0fa442287dac5cb229d4aaa08b6a13d@%3Cissues.hive.apache.org%3E
16
reference_url https://lists.apache.org/thread.html/rd462a8b0dfab4c15e67c0672cd3c211ecd0e4f018f824082ed54f665@%3Cissues.hive.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/rd462a8b0dfab4c15e67c0672cd3c211ecd0e4f018f824082ed54f665@%3Cissues.hive.apache.org%3E
17
reference_url https://lists.apache.org/thread.html/re014a49d77f038ba70e5e9934d400af6653e8c9ac110d32b1254127e@%3Cdev.ranger.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/re014a49d77f038ba70e5e9934d400af6653e8c9ac110d32b1254127e@%3Cdev.ranger.apache.org%3E
18
reference_url https://lists.apache.org/thread.html/rf00d8f4101a1c1ea4de6ea1e09ddf7472cfd306745c90d6da87ae074@%3Cdev.hive.apache.org%3E
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/rf00d8f4101a1c1ea4de6ea1e09ddf7472cfd306745c90d6da87ae074@%3Cdev.hive.apache.org%3E
19
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-5421
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-5421
20
reference_url https://security.netapp.com/advisory/ntap-20210513-0009
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20210513-0009
21
reference_url https://security.netapp.com/advisory/ntap-20210513-0009/
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20210513-0009/
22
reference_url https://tanzu.vmware.com/security/cve-2020-5421
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://tanzu.vmware.com/security/cve-2020-5421
23
reference_url https://www.oracle.com/security-alerts/cpuApr2021.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpuApr2021.html
24
reference_url https://www.oracle.com/security-alerts/cpuapr2022.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpuapr2022.html
25
reference_url https://www.oracle.com/security-alerts/cpujan2021.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpujan2021.html
26
reference_url https://www.oracle.com/security-alerts/cpujan2022.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpujan2022.html
27
reference_url https://www.oracle.com//security-alerts/cpujul2021.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.oracle.com//security-alerts/cpujul2021.html
28
reference_url https://www.oracle.com/security-alerts/cpuoct2021.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpuoct2021.html
29
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1881158
reference_id 1881158
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1881158
30
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=973381
reference_id 973381
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=973381
31
reference_url https://github.com/advisories/GHSA-rv39-3qh7-9v7w
reference_id GHSA-rv39-3qh7-9v7w
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-rv39-3qh7-9v7w
fixed_packages
0
url pkg:maven/org.springframework/spring-core@4.2.9.RELEASE
purl pkg:maven/org.springframework/spring-core@4.2.9.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3rev-eg6f-tkb7
1
vulnerability VCID-6ysx-5wcw-f7b5
2
vulnerability VCID-c74k-e1me-pfb2
3
vulnerability VCID-cyjt-4vjn-mbc7
4
vulnerability VCID-dfs4-emmn-f3eb
5
vulnerability VCID-f3g5-hamr-6yar
6
vulnerability VCID-k17s-ttg2-ubgj
7
vulnerability VCID-pb7f-yasx-17ag
8
vulnerability VCID-pz7c-p4ze-kfhc
9
vulnerability VCID-w6br-v2gm-j7gr
10
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.2.9.RELEASE
1
url pkg:maven/org.springframework/spring-core@4.3.28.RELEASE
purl pkg:maven/org.springframework/spring-core@4.3.28.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cyjt-4vjn-mbc7
3
vulnerability VCID-k17s-ttg2-ubgj
4
vulnerability VCID-w6br-v2gm-j7gr
5
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.3.28.RELEASE
2
url pkg:maven/org.springframework/spring-core@4.3.29.RELEASE
purl pkg:maven/org.springframework/spring-core@4.3.29.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cyjt-4vjn-mbc7
3
vulnerability VCID-k17s-ttg2-ubgj
4
vulnerability VCID-w6br-v2gm-j7gr
5
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.3.29.RELEASE
3
url pkg:maven/org.springframework/spring-core@5.0.18.RELEASE
purl pkg:maven/org.springframework/spring-core@5.0.18.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cyjt-4vjn-mbc7
3
vulnerability VCID-k17s-ttg2-ubgj
4
vulnerability VCID-w6br-v2gm-j7gr
5
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.0.18.RELEASE
4
url pkg:maven/org.springframework/spring-core@5.0.19.RELEASE
purl pkg:maven/org.springframework/spring-core@5.0.19.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cyjt-4vjn-mbc7
3
vulnerability VCID-k17s-ttg2-ubgj
4
vulnerability VCID-w6br-v2gm-j7gr
5
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.0.19.RELEASE
5
url pkg:maven/org.springframework/spring-core@5.1.17.RELEASE
purl pkg:maven/org.springframework/spring-core@5.1.17.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cyjt-4vjn-mbc7
3
vulnerability VCID-k17s-ttg2-ubgj
4
vulnerability VCID-w6br-v2gm-j7gr
5
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.1.17.RELEASE
6
url pkg:maven/org.springframework/spring-core@5.1.18.RELEASE
purl pkg:maven/org.springframework/spring-core@5.1.18.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cyjt-4vjn-mbc7
3
vulnerability VCID-k17s-ttg2-ubgj
4
vulnerability VCID-w6br-v2gm-j7gr
5
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.1.18.RELEASE
7
url pkg:maven/org.springframework/spring-core@5.2.8.RELEASE
purl pkg:maven/org.springframework/spring-core@5.2.8.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cpsj-4k25-wufe
3
vulnerability VCID-cyjt-4vjn-mbc7
4
vulnerability VCID-dy4t-tm9m-rfex
5
vulnerability VCID-k17s-ttg2-ubgj
6
vulnerability VCID-w6br-v2gm-j7gr
7
vulnerability VCID-ygpk-fb56-sqa4
8
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.2.8.RELEASE
8
url pkg:maven/org.springframework/spring-core@5.2.9.RELEASE
purl pkg:maven/org.springframework/spring-core@5.2.9.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-c74k-e1me-pfb2
2
vulnerability VCID-cpsj-4k25-wufe
3
vulnerability VCID-cyjt-4vjn-mbc7
4
vulnerability VCID-dy4t-tm9m-rfex
5
vulnerability VCID-k17s-ttg2-ubgj
6
vulnerability VCID-w6br-v2gm-j7gr
7
vulnerability VCID-ygpk-fb56-sqa4
8
vulnerability VCID-z3th-j593-m7bg
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.2.9.RELEASE
aliases CVE-2020-5421, GHSA-rv39-3qh7-9v7w
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-y3uz-etva-sufh
13
url VCID-z3th-j593-m7bg
vulnerability_id VCID-z3th-j593-m7bg
summary 
Spring Framework vulnerable to denial of service via specially crafted SpEL expression
In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-20861.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-20861.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-20861
reference_id
reference_type
scores
0
value 0.00352
scoring_system epss
scoring_elements 0.57658
published_at 2026-04-09T12:55:00Z
1
value 0.00352
scoring_system epss
scoring_elements 0.57653
published_at 2026-04-08T12:55:00Z
2
value 0.00352
scoring_system epss
scoring_elements 0.576
published_at 2026-04-07T12:55:00Z
3
value 0.00352
scoring_system epss
scoring_elements 0.57625
published_at 2026-04-04T12:55:00Z
4
value 0.00352
scoring_system epss
scoring_elements 0.57604
published_at 2026-04-02T12:55:00Z
5
value 0.00409
scoring_system epss
scoring_elements 0.61275
published_at 2026-04-21T12:55:00Z
6
value 0.00409
scoring_system epss
scoring_elements 0.61283
published_at 2026-04-11T12:55:00Z
7
value 0.00409
scoring_system epss
scoring_elements 0.61269
published_at 2026-04-12T12:55:00Z
8
value 0.00409
scoring_system epss
scoring_elements 0.6125
published_at 2026-04-13T12:55:00Z
9
value 0.00409
scoring_system epss
scoring_elements 0.6129
published_at 2026-04-16T12:55:00Z
10
value 0.00409
scoring_system epss
scoring_elements 0.61295
published_at 2026-04-18T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-20861
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20861
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20861
3
reference_url https://github.com/spring-projects/spring-framework
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework
4
reference_url https://github.com/spring-projects/spring-framework/commit/430fc25acad2e85cbdddcd52b64481691f03ebd1
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/430fc25acad2e85cbdddcd52b64481691f03ebd1
5
reference_url https://github.com/spring-projects/spring-framework/commit/52c93b1c4b24d70de233a958e60e7c5822bd274f
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/52c93b1c4b24d70de233a958e60e7c5822bd274f
6
reference_url https://github.com/spring-projects/spring-framework/commit/935c29e3ddba5b19951e54f6685c70ed45d9cbe5
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/935c29e3ddba5b19951e54f6685c70ed45d9cbe5
7
reference_url https://security.netapp.com/advisory/ntap-20230420-0007
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20230420-0007
8
reference_url https://security.netapp.com/advisory/ntap-20230420-0007/
reference_id
reference_type
scores
0
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T15:31:28Z/
url https://security.netapp.com/advisory/ntap-20230420-0007/
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2180530
reference_id 2180530
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2180530
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-20861
reference_id CVE-2023-20861
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-20861
11
reference_url https://spring.io/security/cve-2023-20861
reference_id CVE-2023-20861
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T15:31:28Z/
url https://spring.io/security/cve-2023-20861
12
reference_url https://github.com/advisories/GHSA-564r-hj7v-mcr5
reference_id GHSA-564r-hj7v-mcr5
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-564r-hj7v-mcr5
13
reference_url https://access.redhat.com/errata/RHSA-2023:2100
reference_id RHSA-2023:2100
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:2100
14
reference_url https://access.redhat.com/errata/RHSA-2023:3185
reference_id RHSA-2023:3185
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:3185
15
reference_url https://access.redhat.com/errata/RHSA-2023:3610
reference_id RHSA-2023:3610
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:3610
16
reference_url https://access.redhat.com/errata/RHSA-2023:3622
reference_id RHSA-2023:3622
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:3622
17
reference_url https://access.redhat.com/errata/RHSA-2023:3771
reference_id RHSA-2023:3771
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:3771
18
reference_url https://access.redhat.com/errata/RHSA-2023:4983
reference_id RHSA-2023:4983
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:4983
19
reference_url https://access.redhat.com/errata/RHSA-2024:0778
reference_id RHSA-2024:0778
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0778
fixed_packages
0
url pkg:maven/org.springframework/spring-core@5.2.23.RELEASE
purl pkg:maven/org.springframework/spring-core@5.2.23.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.2.23.RELEASE
1
url pkg:maven/org.springframework/spring-core@5.3.26
purl pkg:maven/org.springframework/spring-core@5.3.26
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-k2en-h5n1-r7gr
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@5.3.26
2
url pkg:maven/org.springframework/spring-core@6.0.7
purl pkg:maven/org.springframework/spring-core@6.0.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6ysx-5wcw-f7b5
1
vulnerability VCID-k2en-h5n1-r7gr
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@6.0.7
aliases CVE-2023-20861, GHSA-564r-hj7v-mcr5
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-z3th-j593-m7bg
Fixing_vulnerabilities
Risk_score10.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@4.2.0.RELEASE