Overview
About vulnerability
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.
Specifically, an application is vulnerable when the following is true:
- The application evaluates user-supplied SpEL expressions.
Details
- Affected product:
- Apache CXF , Apache Log4j , Apache Struts , Apache Tapestry , Apache Tomcat , Eclipse Jetty , Spring , activemq , camel , castor , cocoon , crash , glassfish-hk2 , jersey , karaf , taglibs-standard-impl , tika
- Affected packages:
- camel-iec60870 @ 2.25.4 (+4135 more)
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.
Specifically, an application is vulnerable when the following is true:
- The application evaluates user-supplied SpEL expressions.