Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/61250?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/61250?format=api", "purl": "pkg:maven/org.springframework/spring-expression@5.3.0", "type": "maven", "namespace": "org.springframework", "name": "spring-expression", "version": "5.3.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "5.3.16", "latest_non_vulnerable_version": "6.0.8", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/44710?format=api", "vulnerability_id": "VCID-amxf-c3z4-gbhk", "summary": "Spring Framework vulnerable to denial of service via specially crafted SpEL expression\nIn Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", "references": [ { "reference_url": "https://github.com/spring-projects/spring-framework/commit/430fc25acad2e85cbdddcd52b64481691f03ebd1", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/spring-projects/spring-framework/commit/430fc25acad2e85cbdddcd52b64481691f03ebd1" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20230420-0007/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20230420-0007/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861", "reference_id": "CVE-2023-20861", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861" }, { "reference_url": "https://spring.io/security/cve-2023-20861", "reference_id": "CVE-2023-20861", "reference_type": "", "scores": [], "url": "https://spring.io/security/cve-2023-20861" }, { "reference_url": "https://github.com/advisories/GHSA-564r-hj7v-mcr5", "reference_id": "GHSA-564r-hj7v-mcr5", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-564r-hj7v-mcr5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/64387?format=api", "purl": "pkg:maven/org.springframework/spring-expression@5.3.26", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-expression@5.3.26" }, { "url": "http://public2.vulnerablecode.io/api/packages/64388?format=api", "purl": "pkg:maven/org.springframework/spring-expression@6.0.7", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-expression@6.0.7" } ], "aliases": [ "CVE-2023-20861", "GHSA-564r-hj7v-mcr5" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-amxf-c3z4-gbhk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/44942?format=api", "vulnerability_id": "VCID-ehpw-txyw-auh6", "summary": "Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')\nIn spring framework versions prior to 5.2.24 release+,5.3.27+ and 6.0.8+, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", "references": [ { "reference_url": "https://github.com/spring-projects/spring-framework/commit/b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/spring-projects/spring-framework/commit/b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20863", "reference_id": "CVE-2023-20863", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20863" }, { "reference_url": "https://spring.io/security/cve-2023-20863", "reference_id": "CVE-2023-20863", "reference_type": "", "scores": [], "url": "https://spring.io/security/cve-2023-20863" }, { "reference_url": "https://github.com/advisories/GHSA-wxqc-pxw9-g2p8", "reference_id": "GHSA-wxqc-pxw9-g2p8", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-wxqc-pxw9-g2p8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/64702?format=api", "purl": "pkg:maven/org.springframework/spring-expression@5.3.27", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-expression@5.3.27" }, { "url": "http://public2.vulnerablecode.io/api/packages/64703?format=api", "purl": "pkg:maven/org.springframework/spring-expression@6.0.8", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-expression@6.0.8" } ], "aliases": [ "CVE-2023-20863", "GHSA-wxqc-pxw9-g2p8" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ehpw-txyw-auh6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/42821?format=api", "vulnerability_id": "VCID-yqhz-ueqh-kfc4", "summary": "Allocation of Resources Without Limits or Throttling in Spring Framework\nIn Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a Denial of Service.", "references": [ { "reference_url": "https://github.com/spring-projects/spring-framework/commit/83ac65915871067c39a4fb255e0d484c785c0c11", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/spring-projects/spring-framework/commit/83ac65915871067c39a4fb255e0d484c785c0c11" }, { "reference_url": "https://github.com/spring-projects/spring-framework/issues/28145", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/spring-projects/spring-framework/issues/28145" }, { "reference_url": "https://github.com/spring-projects/spring-framework/issues/28257", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/spring-projects/spring-framework/issues/28257" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22950", "reference_id": "CVE-2022-22950", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22950" }, { "reference_url": "https://tanzu.vmware.com/security/cve-2022-22950", "reference_id": "CVE-2022-22950", "reference_type": "", "scores": [], "url": "https://tanzu.vmware.com/security/cve-2022-22950" }, { "reference_url": "https://github.com/advisories/GHSA-558x-2xjg-6232", "reference_id": "GHSA-558x-2xjg-6232", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-558x-2xjg-6232" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/61252?format=api", "purl": "pkg:maven/org.springframework/spring-expression@5.3.16", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-expression@5.3.16" } ], "aliases": [ "CVE-2022-22950", "GHSA-558x-2xjg-6232" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-yqhz-ueqh-kfc4" } ], "fixing_vulnerabilities": [], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-expression@5.3.0" }