CVE-2021-22060

2022-01-0722:39:55

vmware

www.cve.org

5.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.3%

JSON

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.

CNA Affected

[
  {
    "product": "Spring Framework",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Spring Framework 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions"
      }
    ]
  }
]