CVE-2025-22235

🗓️ 28 Apr 2025 07:10:35Reported by vmwareType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 389 Views

CVE-2025-22235 affects Spring Security with EndpointRequest.to() creating incorrect matcher for null.

Reporter	Title	Published	Views	Family All 46
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench	30 Oct 202520:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in Spring [CVE-2025-22235]	28 Aug 202517:08	–	ibm
IBM Security Bulletins	Security Bulletin: EndpointRequest.to() creates a matcher for null/** if the actuator endpoint is disabled or not exposed, which affects IBM watsonx.data	1 Sep 202514:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	7 Jul 202517:00	–	ibm
IBM Security Bulletins	Security Bulletin: Remediation of Multiple Spring Vulnerabilities in IBM Library Support for Spring	16 Jan 202609:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for Oct 2025 - Multiple CVEs addressed	26 Nov 202503:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in Spring boot and Spring Security	24 Oct 202506:57	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerability in Spring Boot Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-22235)	12 Jun 202618:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms	14 Jul 202614:37	–	ibm
Atlassian	Improper Authorization Third-Party Dependency in Bitbucket Data Center and Server - CVE-2025-22235	14 Nov 202506:28	–	atlassian

[
  {
    "defaultStatus": "unaffected",
    "product": "Spring Boot",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "2.7.25",
        "status": "affected",
        "version": "2.7.x",
        "versionType": "Enterprise Support Only"
      },
      {
        "lessThan": "3.1.16",
        "status": "affected",
        "version": "3.1.x",
        "versionType": "Enterprise Support Only"
      },
      {
        "lessThan": "3.2.14",
        "status": "affected",
        "version": "3.2.x",
        "versionType": "Enterprise Support Only"
      },
      {
        "lessThan": "3.3.11",
        "status": "affected",
        "version": "3.3.x",
        "versionType": "OSS"
      },
      {
        "lessThan": "3.4.5",
        "status": "affected",
        "version": "3.4.x",
        "versionType": "OSS"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2025-22235
security	www.security.netapp.com/advisory/ntap-20250516-0010/

17 Jun 2026 08:45Current

7.2High risk

Vulners AI Score7.2

CVSS 3.17.3

EPSS0.00386

SSVC

CWE-20