Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.springframework/spring-beans@2.5.3
Typemaven
Namespaceorg.springframework
Namespring-beans
Version2.5.3
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version5.2.20
Latest_non_vulnerable_version5.3.20
Affected_by_vulnerabilities
0
url VCID-e3yh-y2av-wff3
vulnerability_id VCID-e3yh-y2av-wff3
summary In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22970.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22970.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-22970
reference_id
reference_type
scores
0
value 0.00164
scoring_system epss
scoring_elements 0.37134
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-22970
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22970
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22970
3
reference_url https://github.com/spring-projects/spring-framework
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework
4
reference_url https://github.com/spring-projects/spring-framework/commit/50177b1ad3485bd44239b1756f6c14607476fcf2
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/50177b1ad3485bd44239b1756f6c14607476fcf2
5
reference_url https://github.com/spring-projects/spring-framework/commit/83186b689f11f5e6efe7ccc08fdeb92f66fcd583
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/83186b689f11f5e6efe7ccc08fdeb92f66fcd583
6
reference_url https://security.netapp.com/advisory/ntap-20220616-0006
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20220616-0006
7
reference_url https://security.netapp.com/advisory/ntap-20220616-0006/
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20220616-0006/
8
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2087272
reference_id 2087272
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2087272
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-22970
reference_id CVE-2022-22970
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-22970
10
reference_url https://tanzu.vmware.com/security/cve-2022-22970
reference_id CVE-2022-22970
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://tanzu.vmware.com/security/cve-2022-22970
11
reference_url https://github.com/advisories/GHSA-hh26-6xwr-ggv7
reference_id GHSA-hh26-6xwr-ggv7
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-hh26-6xwr-ggv7
12
reference_url https://access.redhat.com/errata/RHSA-2022:5532
reference_id RHSA-2022:5532
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:5532
13
reference_url https://access.redhat.com/errata/RHSA-2023:1661
reference_id RHSA-2023:1661
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:1661
14
reference_url https://access.redhat.com/errata/RHSA-2023:3185
reference_id RHSA-2023:3185
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:3185
fixed_packages
0
url pkg:maven/org.springframework/spring-beans@5.2.22.RELEASE
purl pkg:maven/org.springframework/spring-beans@5.2.22.RELEASE
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-beans@5.2.22.RELEASE
1
url pkg:maven/org.springframework/spring-beans@5.3.20
purl pkg:maven/org.springframework/spring-beans@5.3.20
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-beans@5.3.20
aliases CVE-2022-22970, GHSA-hh26-6xwr-ggv7
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-e3yh-y2av-wff3
1
url VCID-n3z8-z3gf-zydq
vulnerability_id VCID-n3z8-z3gf-zydq
summary A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22965.json
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22965.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-22965
reference_id
reference_type
scores
0
value 0.94439
scoring_system epss
scoring_elements 0.9999
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-22965
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965
3
reference_url https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12
4
reference_url https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6
5
reference_url https://github.com/spring-projects/spring-framework
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework
6
reference_url https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15
7
reference_url https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE
8
reference_url https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18
9
reference_url https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
10
reference_url https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#suggested-workarounds
reference_id
reference_type
scores
url https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#suggested-workarounds
11
reference_url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965
12
reference_url https://www.kb.cert.org/vuls/id/970766
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.kb.cert.org/vuls/id/970766
13
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2070348
reference_id 2070348
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2070348
14
reference_url https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
reference_id cisco-sa-java-spring-rce-Zx9GUc67
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
15
reference_url https://www.oracle.com/security-alerts/cpuapr2022.html
reference_id cpuapr2022.html
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url https://www.oracle.com/security-alerts/cpuapr2022.html
16
reference_url https://www.oracle.com/security-alerts/cpujul2022.html
reference_id cpujul2022.html
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url https://www.oracle.com/security-alerts/cpujul2022.html
17
reference_url https://tanzu.vmware.com/security/cve-2022-22965
reference_id cve-2022-22965
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url https://tanzu.vmware.com/security/cve-2022-22965
18
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-22965
reference_id CVE-2022-22965
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-22965
19
reference_url https://github.com/advisories/GHSA-36p3-wjmg-h94x
reference_id GHSA-36p3-wjmg-h94x
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-36p3-wjmg-h94x
20
reference_url https://access.redhat.com/errata/RHSA-2022:1306
reference_id RHSA-2022:1306
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:1306
21
reference_url https://access.redhat.com/errata/RHSA-2022:1333
reference_id RHSA-2022:1333
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:1333
22
reference_url https://access.redhat.com/errata/RHSA-2022:1360
reference_id RHSA-2022:1360
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:1360
23
reference_url https://access.redhat.com/errata/RHSA-2022:1378
reference_id RHSA-2022:1378
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:1378
24
reference_url https://access.redhat.com/errata/RHSA-2022:1379
reference_id RHSA-2022:1379
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:1379
25
reference_url https://access.redhat.com/errata/RHSA-2022:1626
reference_id RHSA-2022:1626
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:1626
26
reference_url https://access.redhat.com/errata/RHSA-2022:1627
reference_id RHSA-2022:1627
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:1627
27
reference_url https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
reference_id SNWLID-2022-0005
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
28
reference_url http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
reference_id Spring4Shell-Code-Execution.html
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
29
reference_url http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
reference_id Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
30
reference_url https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
reference_id ssa-254054.pdf
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
url https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
31
reference_url https://usn.ubuntu.com/7165-1/
reference_id USN-7165-1
reference_type
scores
url https://usn.ubuntu.com/7165-1/
fixed_packages
0
url pkg:maven/org.springframework/spring-beans@5.2.20
purl pkg:maven/org.springframework/spring-beans@5.2.20
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-beans@5.2.20
1
url pkg:maven/org.springframework/spring-beans@5.2.20.RELEASE
purl pkg:maven/org.springframework/spring-beans@5.2.20.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-e3yh-y2av-wff3
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-beans@5.2.20.RELEASE
2
url pkg:maven/org.springframework/spring-beans@5.3.18
purl pkg:maven/org.springframework/spring-beans@5.3.18
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-e3yh-y2av-wff3
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-beans@5.3.18
aliases CVE-2022-22965, GHSA-36p3-wjmg-h94x, GMS-2022-558, GMS-2022-559, GMS-2022-560, GMS-2022-561
risk_score 10.0
exploitability 2.0
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-n3z8-z3gf-zydq
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-beans@2.5.3