CVE-2024-22236

🗓️ 31 Jan 2024 06:54:51Reported by vmwareType

In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in the org.springframework.cloud:spring-cloud-contract-shade dependency

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2024-22236	31 Jan 202408:22	–	circl
CNNVD	Spring Cloud Security Vulnerabilities	31 Jan 202400:00	–	cnnvd
Cvelist	CVE-2024-22236	31 Jan 202406:54	–	cvelist
EUVD	EUVD-2024-0392	3 Oct 202520:07	–	euvd
Github Security Blog	Spring Cloud Contract vulnerable to local information disclosure	31 Jan 202409:30	–	github
NVD	CVE-2024-22236	31 Jan 202407:15	–	nvd
OSV	CVE-2024-22236	31 Jan 202407:15	–	osv
OSV	GHSA-P6RP-MX85-M459 Spring Cloud Contract vulnerable to local information disclosure	31 Jan 202409:30	–	osv
Prion	Information disclosure	31 Jan 202407:15	–	prion
Positive Technologies	PT-2024-19288 · Google +1 · Guava +1	31 Jan 202400:00	–	ptsecurity

NVD

Node

vmware spring_cloud_contractRange3.1.0–3.1.10

vmware spring_cloud_contractRange4.0.0–4.0.5

vmware spring_cloud_contractMatch4.1.0

[
  {
    "defaultStatus": "unaffected",
    "product": "Spring Cloud Contract",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "4.1.1",
        "status": "affected",
        "version": "4.1.0",
        "versionType": "4.1.1"
      },
      {
        "lessThan": "4.0.6",
        "status": "affected",
        "version": "4.0.0",
        "versionType": "4.0.6"
      },
      {
        "lessThan": "3.1.10",
        "status": "affected",
        "version": "3.1.0",
        "versionType": "3.1.10"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2024-22236

03 Jun 2025 19:15Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.13.3 - 5.5

EPSS0.00097

SSVC