GHSA-VPR3-F594-MG5G Improper Control of Generation of Code ('Code Injection') in Spring Framework

🗓️ 17 May 2022 03:28:34Reported by GoogleType

osv

osv🔗 osv.dev👁 5 Views

Spring Framework remote code execution via crafted jar URL in class loader URLs from a web request.

Reporter	Title	Published	Views	Family All 40
Gitee	Exploit for Code Injection in Vmware Spring_Framework	5 May 202217:21	–	gitee
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	5 Apr 202220:34	–	githubexploit
GithubExploit	Exploit for Code Injection in Oracle Fusion_Middleware	31 Mar 202208:06	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	29 Apr 202209:58	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	31 Mar 202216:14	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	19 May 202223:16	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Security Directory Integrator is affected by multiple security vulnerabilities	22 Jun 202316:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities	18 Feb 201914:10	–	ibm
Information Security Automation	Spring4Shell, Spring Cloud Function RCE and Spring Cloud Gateway Code Injection	3 Apr 202200:15	–	avleonov
BDU FSTEC	The vulnerability of the Spring Framework software platform, related to improper code generation management, allows attackers to execute arbitrary code.	31 Aug 202200:00	–	bdu_fstec

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2010-1622
github	www.github.com/spring-projects/spring-framework/commit/3a5af35d37c79d0644d49b93f792a4c18fe8eb71
access	www.access.redhat.com/errata/RHSA-2011:0175
access	www.access.redhat.com/security/cve/CVE-2010-1622
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/spring-projects/spring-framework
seclists	www.seclists.org/fulldisclosure/2010/Jun/456
web	www.web.archive.org/web/20100623011648/http://www.springsource.com/security/cve-2010-1622
web	www.web.archive.org/web/20161014113129/http://www.securitytracker.com/id/1033898
web	www.web.archive.org/web/20200227210033/http://www.securityfocus.com/archive/1/511877

03 Dec 2024 06:08Current

7.6High risk

Vulners AI Score7.6

CVSS 26

EPSS0.52003

spring framework remote code execution crafted jar URL class loader URLs web request