PT-2024-7296

Name of the Vulnerable Software and Affected Versions: org.springframework:spring-web versions 5.3.0 through 5.3.37 org.springframework:spring-web versions 6.0.0 through 6.0.22 org.springframework:spring-web versions 6.1.0 through 6.1.11 Description: Applications that parse ETags from If-Match or...

Security Bulletin: Vulnerability with Perl, Snappy, Psf Request, spring-web-5.3.33.jar , Apache HTTP Server, OpenJDK, affect IBM Cloud Object Storage Systems (July 2024v1)

Summary Vulnerability with Perl CVE-2023-47038, Snappy CVE-2024-36124, Psf Request CVE-2024-35195, spring-web-5.3.33.jar CVE-2024-22262 , Apache HTTP Server, CVE-2024-24795, CVE-2023-38709 OpenJDK CVE-2024-21094, CVE-2024-21011, CVE-2024-21085, CVE-2024-21068, CVE-2024-21012,. This vulnerability...

SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Crowd Data Center and Server

This High severity org.springframework:spring-web Dependency vulnerability was introduced in versions 5.1.0, 5.2.0, and 5.3.0 of Crowd Data Center and Server. This org.springframework:spring-web Dependency vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

SSRF (Server-Side Request Forgery) org.springframework:spring-web Dependency in Crowd Data Center and Server

This High severity org.springframework:spring-web Dependency vulnerability was introduced in versions 5.1.0, 5.2.0, and 5.3.0 of Crowd Data Center and Server. This org.springframework:spring-web Dependency vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in spring-web-5.3.15.jar

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of spring-web-5.3.15.jar Vulnerability Details CVEID:CVE-2024-22243 DESCRIPTION: VMware Tanzu Spring Framework could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability...

RHEL 7 : jasperreports-server-pro (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jackson-databind: Unsafe deserialization due to incomplete black list incomplete fix for CVE-2017-15095...

RHEL 7 : spring-webflow (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - spring-webflow: Data Binding Expression Vulnerability in Spring Web Flow CVE-2017-8039 - An issue was...

Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to privilege escalation due to Spring-Web (CVE-2023-44794)

Summary IBM Sterling Connect:Direct Web Services uses Spring-Web. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-44794 DESCRIPTION: Dromara SaToken and SpringBoot could allow a remote authenticated attacker to gain elevated privileg...

Open Redirect

org.springframework: spring-web is vulnerable Open Redirect. The vulnerability is caused due to improper validation checks on the host of the parsed URL, which could lead to potential SSRF attacks if the URL is utilized post-validation...

com.mysema.web:webmin (0.2.3), org.jumpmind.symmetric:symmetric-ds (1.3.2) +17 more potentially affected by CVE-2024-22262 via org.springframework:spring-web (2.0.7)

org.springframework:spring-web MAVEN version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.mysema.web:webmin 0.2.3 - org.jumpmind.symmetric:symmetric-ds 1.3.2 - org.parancoe:parancoe 0.3...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2) +67 more potentially affected by CVE-2024-22262 via org.springframework:spring-web (2.5.1)

org.springframework:spring-web MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - br.net.woodstock.rockframework:rockframework-domain =1.2.1, =1.2.1, =0.7, =1.3, =1.4, =1.4, =1.5.2,...

com.sun.jersey:jersey-spring (0.8-ea), org.springframework.ws:spring-ws-core (1.5.0) +5 more potentially affected by CVE-2024-22262 via org.springframework:spring-web (2.5.2)

org.springframework:spring-web MAVEN version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.sun.jersey:jersey-spring 0.8-ea - org.springframework.ws:spring-ws-core 1.5.0 -...

org.apache.struts:struts2-portlet (>=2.1.2, <=2.1.6), org.apache.struts:struts2-showcase (>=2.1.2, <=2.1.6) +18 more potentially affected by CVE-2024-22262 via org.springframework:spring-web (2.5.3)

org.springframework:spring-web MAVEN version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.apache.struts:struts2-portlet =2.1.2, =2.1.2, =2.1.2, =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.0.1,...

com.custardsource.parfait:parfait-cxf (>=0.2.0, <=0.3.9), edu.usc.ir:lucene-geo-gazetteer (0.2) +117 more potentially affected by CVE-2024-22262 via org.springframework:spring-web (2.5.5)

org.springframework:spring-web MAVEN version 2.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.custardsource.parfait:parfait-cxf =0.2.0, =1.0.15, =1.0.15, =1.0.15, =0.4.0, =1.4.0, =1.4.0,...

com.discursive.taglib.reference:reference-taglib (1.0.1), com.exadel.flamingo.maven.plugin:flamingoapp (>=1.0.0, <=1.5.0) +22 more potentially affected by CVE-2024-22262 via org.springframework:spring-web (1.2.7)

org.springframework:spring-web MAVEN version 1.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.discursive.taglib.reference:reference-taglib 1.0.1 - com.exadel.flamingo.maven.plugin:flamingoa...

net.sourceforge.openutils:openutils-spring (0.2) potentially affected by CVE-2024-22262 via org.springframework:spring-web (2.0-m5)

org.springframework:spring-web MAVEN version 2.0-m5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - net.sourceforge.openutils:openutils-spring 0.2 Source cves: CVE-2024-22262 Source advisory:...

ch.ralscha:extdirectspring (>=1.0.0, <=1.0.1), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +174 more potentially affected by CVE-2024-22262 via org.springframework:spring-web (3.0.3.release)

org.springframework:spring-web MAVEN version 3.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ch.ralscha:extdirectspring =1.0.0, =22.0.2-beta, =1.0.0-beta-1, =1.1, =0.9-milestone8.3,...

at.molindo:molindo-notify (>=1.0.0-alpha-1, <=1.0.0-alpha-2), ca.grimoire.spring:spring-request-aware (1.0) +98 more potentially affected by CVE-2024-22262 via org.springframework:spring-web (3.0.4.release)

org.springframework:spring-web MAVEN version 3.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - at.molindo:molindo-notify =1.0.0-alpha-1, =1.0.2, =1.0.3, =1.0.1, =1.0-beta-1, =0.7.1, =0.2...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.4, <=3.0.1), br.net.woodstock.rockframework:rockframework-faces (>=2.0.0, <=2.0.8) +414 more potentially affected by CVE-2024-22262 via org.springframework:spring-web (3.0.6.release)

org.springframework:spring-web MAVEN version 3.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - br.net.woodstock.rockframework:rockframework-domain =1.2.4, =2.0.0, =2.0.0, =2.0.0, =1.2.4,...

com.ctlok:spring-webmvc-rythm (>=1.3.6, <=1.4.2), com.github.lltyk:tapestry-spring-security (>=3.0.4, <=3.0.5) +143 more potentially affected by CVE-2024-22262 via org.springframework:spring-web (3.1.0.release)

org.springframework:spring-web MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.ctlok:spring-webmvc-rythm =1.3.6, =3.0.4, =0.1, =0.9.0, =0.9.0, =3.3, =2.1.1, =0.1.5,...