Lucene search

[email protected]CVE-2022-22971

HistoryMay 12, 2022 - 8:15 p.m.

CVE-2022-22971

2022-05-1220:15:15

CWE-770

[email protected]

web.nvd.nist.gov

1027

cve-2022-22971

spring framework

websocket

stomp

denial of service

nvd

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.2 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

79.1%

JSON

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

Affected configurations

NVD

Node

vmwarespring_frameworkRange5.2.0–5.2.21

vmwarespring_frameworkRange5.3.0–5.3.19

Node

oraclefinancial_services_crime_and_compliance_management_studioMatch8.0.8.2.0

oraclefinancial_services_crime_and_compliance_management_studioMatch8.0.8.3.0

Node

netappcloud_secure_agentMatch-

netapponcommand_insightMatch-

CPENameOperatorVersion
vmware:spring_frameworkvmware spring frameworkle5.2.21
vmware:spring_frameworkvmware spring frameworkle5.3.19

CPE	Name	Operator	Version
vmware:spring_framework	vmware spring framework	le	5.2.21
vmware:spring_framework	vmware spring framework	le	5.3.19

CNA Affected

[
  {
    "product": "Spring Framework",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Spring Framework versions 5.3.x prior to 5.3.20, 5.2.x prior to 5.2.22 and all old and unsupported versions"
      }
    ]
  }
]