org.springframework/spring vulnerabilities

Latest org.springframework/spring CVEs

Newest publication first

1. CVE-2023-20860 Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

   Published 2023-03-27

   High·CVSS 7.5

   Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

2. CVE-2021-22096 Improper Output Neutralization for Logs in Spring Framework

   Published 2021-10-28

   Medium·CVSS 4.3

   In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

3. CVE-2010-1622 Improper Control of Generation of Code ('Code Injection') in Spring Framework

   Published 2010-06-21

   Medium·CVSS 6.0 EPSS 52.0% Public exploit

   SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.