CVE-2021-22118

2021-05-2714:48:16

CWE-269

vmware

www.cve.org

8.7 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.2%

JSON

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.

CNA Affected

[
  {
    "product": "Spring Framework",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Spring Framework versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7"
      }
    ]
  }
]