spring-RCE-CVE-2022-22965

취약점 개요 최근 Spring에서 대규모 CVE 취약점이 발견되었습니다. CVE 정보에 따르면 "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as...

Spring MVC Framework - Local File Inclusion

Spring MVC Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported are vulnerable to local file inclusion because they allow applications to configure Spring MVC to serve static resources e.g. CSS, JS, images. A malicious user can send a request using a...

cve-2023-34035-mitigations

이 저장소는 애플리케이션이 https://spring.io/security/cve-2023-34035CVE-2023-34035에 취약할 수 있는 구성을 보여주는 샘플 모음입니다. 다음 조건이 모두 참일 때 애플리케이션이 취약합니다: Spring MVC가 클래스패스에 있습니다 DispatcherServlet과 최소 하나 이상의 다른 서블릿이 매핑되어 있으며, 그중 하나가 경로 기반 서블릿 매핑예: /path/을 가지고 있습니다 애플리케이션이 /path/ 형식의 서블릿 매핑을 가진 엔드포인트를 참조하기 위해...

CLEANSTART-2026-IL27901 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the apache-nifi-registry package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

CLEANSTART-2026-SB20243 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)

Security vulnerability affects the apache-nifi-registry package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

CVE-2022-22965

Spring4Shell 취약점 - CVE-2022-22965 📕 소개 Spring4Shell 취약점은 2022년 초 공격자들이 발견하고 널리 악용한 2개의 취약점 때문에 이렇게 명명되었습니다. 이 취약점 중 하나는 "Spring Cloud Functions"라는 프레임워크 구성 요소덜 중요에 있으며, 두 번째이자 더 중요한 구성 요소는 "Spring Core"라는 프레임워크의 핵심에 있습니다. 이 2개의 중요한 취약점으로 인해 2021년에 공개된 또 다른 중요한 취약점인 Log4shell과 관련하여 커뮤니티에서 농담이 생겼습니...

PoC-CVE-2022-22965-Spring4Shell

PoC — CVE-2022-22965 Spring4Shell 免責事項: このリポジトリは 教育および研究目的のみ を意図しています。 すべてのエクスプロイトスクリプトは、自分が所有するシステム、または明示的な書面による 許可を得たシステムに対してのみ使用する必要があります。著者は、この資料の誤用または損害について一切責任を負いません。 CVE-2022-22965は、2022年4月に公開されたSpring Frameworkにおける重大なリモートコード実行（RCE）脆弱性であり、その調査と概念実証（PoC）です。 脆弱性の概要 Spring4Shell...

CLEANSTART-2026-ZG60550 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)

Security vulnerability affects the rundeck package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

CLEANSTART-2026-SC51338 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the rundeck package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

CLEANSTART-2026-WP23886 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments

Security vulnerability affects the rundeck package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...

CLEANSTART-2026-XW09106 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect

Security vulnerability affects the rundeck package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...

CLEANSTART-2026-GO94409 Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly speci...

Security vulnerability affects the rundeck package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified...

Security Bulletin: As an Spring MVC application, IBM Sterling Control Center is vulnerable to Path Traversal, Open Redirect and CRLF Injection (CVE-2026-47884, CVE-2026-47887, CVE-2026-47890)

Summary Spring MVC framework is used by IBM Sterling Control Center and as part of dependency one of them is in spring-webmvc-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an...

CVE-2026-47883

CVE-2026-47883: Spring Framework UrlHandlerFilter Open Redirect PoC このリポジトリは、Spring公式セキュリティアドバイザリとして公開された CVE-2026-47883 の最小再現PoCです。 公式アドバイザリ: https://spring.io/security/cve-2026-47883/ 公式タイトル: Spring Framework Open Redirect in UrlHandlerFilter 深刻度: Medium CVSS v3.1: 5.4...

Spring Framework 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 SSE Stream Corruption

The version of Spring Framework installed on the remote host is 5.3.x prior to 5.3.50, 6.0.x prior to 6.0.31, 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by a vulnerability: - Spring MVC applications using the functional web framework are...

Security Bulletin: Vulnerabilities in netty-codec, spring-webflux, spring-data, Spring MVC, Immutable and ACE might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in netty-codec, spring-webflux, spring-data, Spring MVC, Immutable and ACE. Vulnerabilities include Netty can cause native memory exhaustion, An attacker can bypass the short-circuit mechanism by sending a reques...

CVE-2026-103088

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the view name parameter in a Spring MVC application when a file: template prefix is used. An attacker can access files outside the configured template base directory by submitting a percent-encoded traversal...

CVE-2026-103088

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a...

EUVD-2026-89555

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a...