Search for packages
| purl | pkg:maven/org.springframework/spring-core@5.2.0 |
| Tags | Ghost |
| Next non-vulnerable version | 5.2.24.RELEASE |
| Latest non-vulnerable version | 6.2.11 |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-cpsj-4k25-wufe
Aliases: CVE-2021-22118 GHSA-gfwj-fwqj-fp3v |
Improper Privilege Management in Spring Framework In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data. |
Affected by 8 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 9 other vulnerabilities. |
|
VCID-dy4t-tm9m-rfex
Aliases: CVE-2022-22950 GHSA-558x-2xjg-6232 |
Allocation of Resources Without Limits or Throttling in Spring Framework In Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a Denial of Service. |
Affected by 5 other vulnerabilities. Affected by 7 other vulnerabilities. |
|
VCID-vvyu-uk8r-wuaz
Aliases: CVE-2021-22060 GHSA-6gf2-pvqw-37ph |
Log entry injection in Spring Framework In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase. |
Affected by 0 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
VCID-y3uz-etva-sufh
Aliases: CVE-2020-5421 GHSA-rv39-3qh7-9v7w |
Improper Input Validation in Spring Framework In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter. |
Affected by 9 other vulnerabilities. Affected by 9 other vulnerabilities. |
|
VCID-ygpk-fb56-sqa4
Aliases: CVE-2021-22096 GHSA-rfmp-97jj-h8m6 |
Improper Output Neutralization for Logs in Spring Framework In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. |
Affected by 7 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 8 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||