CVE-2024-22262

🗓️ 16 Apr 2024 05:54:12Reported by vmwareType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 298 Views🌐 WEB

Applications vulnerable to open redirect and SSRF attacks when using UriComponentsBuilder to parse externally provided URL

Reporter	Title	Published	Views	Family All 234
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance - Identity Manager has multiple vulnerabilities	11 Jul 202407:21	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability with Perl, Snappy, Psf Request, spring-web-5.3.33.jar , Apache HTTP Server, OpenJDK, affect IBM Cloud Object Storage Systems (July 2024v1)	12 Jul 202415:44	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in VMware Tanzu Spring Framework affects IBM Process Mining CVE-2024-22262	28 Jun 202415:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for May 2024 - Multiple CVEs addressed	14 Jun 202409:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Analytics Content Hub is affected by security vulnerabilities	27 Nov 202414:26	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	17 Jun 202420:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in spring-web-5.3.26.jar	7 Jul 202517:58	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in VMware Tanzu Spring Framework affects watsonx.data	14 Aug 202415:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to multiple issues due to VMware Tanzu Spring	12 Jun 202409:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Controller is affected by vulnerabilities	15 Apr 202502:55	–	ibm

Vulners

Vulnrichment

Node

vmware spring_frameworkRange6.1–6.1.6

vmware spring_frameworkRange6.0–6.0.19

vmware spring_frameworkRange5.3–5.3.34

[
  {
    "defaultStatus": "affected",
    "product": "Spring Framework",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "6.1.6",
        "status": "affected",
        "version": "6.1.x",
        "versionType": "6.1.6"
      },
      {
        "lessThan": "6.0.19",
        "status": "affected",
        "version": "6.0.x",
        "versionType": "6.0.19"
      },
      {
        "lessThan": "5.3.34",
        "status": "affected",
        "version": "5.3.x",
        "versionType": "5.3.34"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2024-22262
security	www.security.netapp.com/advisory/ntap-20240524-0003/

Parameter	Position	Path	Description	CWE
url	query param	/redirect	The /redirect endpoint is vulnerable to open redirect because Spring's UriComponentsBuilder parses the 'userinfo' segment of a URL incorrectly when it contains a left bracket '['.	CWE-601
url	query param	/health-check	The /health-check endpoint is vulnerable to SSRF because Spring's UriComponentsBuilder parses the 'userinfo' segment of a URL differently than the standard Java URL class, allowing for host validation bypasses.	CWE-918

17 Jun 2026 07:11Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.18.1

EPSS0.01191

SSVC