spring-webmvc-4.3.30.RELEASE.jar: 2 vulnerabilities (highest severity is: 5.3) [master] (unreachable) #36
Description
📂 Vulnerable Library - spring-webmvc-4.3.30.RELEASE.jar
Spring Web MVC
Library home page: https://projects.spring.io/spring-framework
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-webmvc/4.3.30.RELEASE/spring-webmvc-4.3.30.RELEASE.jar
Findings
| Finding | Severity | 🎯 CVSS | Exploit Maturity | EPSS | Library | Type | Fixed in | Remediation Available | Reachability |
|---|---|---|---|---|---|---|---|---|---|
| CVE-2021-22096 | 🟠 Medium | 5.3 | Not Defined | < 1% | spring-webmvc-4.3.30.RELEASE.jar | Direct | N/A | ❌ |  Unreachable |
| CVE-2024-38820 | 🟡 Low | 2.3 | Not Defined | < 1% | spring-webmvc-4.3.30.RELEASE.jar | Direct | org.springframework:spring-context:6.1.14 | ✅ |
Details
🟠CVE-2021-22096
Vulnerable Library - spring-webmvc-4.3.30.RELEASE.jar
Spring Web MVC
Library home page: https://projects.spring.io/spring-framework
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-webmvc/4.3.30.RELEASE/spring-webmvc-4.3.30.RELEASE.jar
Dependency Hierarchy:
- ❌ spring-webmvc-4.3.30.RELEASE.jar (Vulnerable Library)
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.
Publish Date: Oct 28, 2021 03:22 PM
URL: CVE-2021-22096
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 5.3
Suggested Fix
Type: Upgrade version
Origin:
Release Date:
Fix Resolution :
🟡CVE-2024-38820
Vulnerable Library - spring-webmvc-4.3.30.RELEASE.jar
Spring Web MVC
Library home page: https://projects.spring.io/spring-framework
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-webmvc/4.3.30.RELEASE/spring-webmvc-4.3.30.RELEASE.jar
Dependency Hierarchy:
- ❌ spring-webmvc-4.3.30.RELEASE.jar (Vulnerable Library)
Vulnerability Details
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
Publish Date: Oct 18, 2024 05:39 AM
URL: CVE-2024-38820
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 2.3
Suggested Fix
Type: Upgrade version
Origin: GHSA-4gc7-5j7h-4qph
Release Date: Oct 18, 2024 05:39 AM
Fix Resolution : org.springframework:spring-context:6.1.14