|
Vulnerabilities
< Back

CVE-2022-22970

Updated on 12 May 2022

Severity

5.3 Medium severity

Details

CVSS score
5.3
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

Details

Affected product:
Apache Struts , Apache Tapestry , Apache Tomcat , Eclipse Jetty , Spring , acegi-security , activemq , camel , cocoon , cxf , dependency-management-plugin , jersey , karaf , logging-log4j2 , taglibs-standard-impl
Affected packages:
spring-cloud-config-client @ 2.2.6.RELEASE (+1911 more)
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

Fixes