Spring Framework Zero-Day Remote Code Execution (Spring4Shell) Vulnerability

This page last updated: April 7th A new zero-day Remote Code Execution RCE vulnerability, “Spring4Shell” or “SpringShell” was disclosed in the Spring framework. An unauthorized attacker can exploit this vulnerability to remotely execute arbitrary code on the target device. What is Spring Framewor...

Spring-webmvc command execution vulnerability in hessian-based remote service calls

spring-webmvc is a java development framework. A command execution vulnerability exists in spring-webmvc's hessian-based remote service invocation, which can be exploited by an attacker to gain control of the server...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=1.12.0), au.org.consumerdatastandards:data-holder (>=1.0.0, <=1.12.0) +1443 more potentially affected by CVE-2020-5397 via org.springframework:spring-webmvc (>=5.2.0.release, <=5.2.2.release)

org.springframework:spring-webmvc MAVEN version =5.2.0.release, =1.1.1, =1.0.0, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.1, =0.0.3 - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-igpacks 4.1.0 and...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=1.12.0), au.org.consumerdatastandards:data-holder (>=1.0.0, <=1.12.0) +1443 more potentially affected by CVE-2020-5397 via org.springframework:spring-webmvc (>=5.2.0.release, <=5.2.2.release)

org.springframework:spring-webmvc MAVEN version =5.2.0.release, =1.1.1, =1.0.0, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.1, =0.0.3 - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-igpacks 4.1.0 and...

ai.ost:fastjson-protobuf (>=0.1.1, <=1.0.0), ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1) +2373 more potentially affected by CVE-2020-5398 via org.springframework:spring-webmvc (>=5.0.0.release, <=5.0.15.release)

org.springframework:spring-webmvc MAVEN version =5.0.0.release, =0.1.1, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =0.0.2, =0.0.3, =2.0.3.release, =2.0.2.release, =1.0.3.release, =2.0.0, =1.0.0, =1.0.0, =0.0.8-alpha, =0.0.17-alpha and more Source cves:...

ai.ost:fastjson-protobuf (>=0.1.1, <=1.0.0), ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1) +2373 more potentially affected by CVE-2020-5398 via org.springframework:spring-webmvc (>=5.0.0.release, <=5.0.15.release)

org.springframework:spring-webmvc MAVEN version =5.0.0.release, =0.1.1, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =0.0.2, =0.0.3, =2.0.3.release, =2.0.2.release, =1.0.3.release, =2.0.0, =1.0.0, =1.0.0, =0.0.8-alpha, =0.0.17-alpha and more Source cves:...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.21) +3813 more potentially affected by CVE-2020-5398 via org.springframework:spring-webmvc (>=5.1.0.release, <=5.1.12.release)

org.springframework:spring-webmvc MAVEN version =5.1.0.release, =4.4.0.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr1, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 - ai.ylyue:yue-library-web 2.1.0 and more Source cves: CVE-2020-5398 Source...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.21) +3813 more potentially affected by CVE-2020-5398 via org.springframework:spring-webmvc (>=5.1.0.release, <=5.1.12.release)

org.springframework:spring-webmvc MAVEN version =5.1.0.release, =4.4.0.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr1, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 - ai.ylyue:yue-library-web 2.1.0 and more Source cves: CVE-2020-5398 Source...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=1.12.0), au.org.consumerdatastandards:data-holder (>=1.0.0, <=1.12.0) +1443 more potentially affected by CVE-2020-5398 via org.springframework:spring-webmvc (>=5.2.0.release, <=5.2.2.release)

org.springframework:spring-webmvc MAVEN version =5.2.0.release, =1.1.1, =1.0.0, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.1, =0.0.3 - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-igpacks 4.1.0 and...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=1.12.0), au.org.consumerdatastandards:data-holder (>=1.0.0, <=1.12.0) +1443 more potentially affected by CVE-2020-5398 via org.springframework:spring-webmvc (>=5.2.0.release, <=5.2.2.release)

org.springframework:spring-webmvc MAVEN version =5.2.0.release, =1.1.1, =1.0.0, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.1, =0.0.3 - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-igpacks 4.1.0 and...

UBUNTU-CVE-2020-5397

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not inclu...

CVE-2020-5397

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not inclu...

CVE-2020-5397

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not inclu...

CVE-2020-5397: Cross-Site Request Forgery (CSRF)

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not inclu...

ai.ost:fastjson-protobuf (>=0.1.1, <=1.0.0), ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1) +2373 more potentially affected by CVE-2020-5398 via org.springframework:spring-webmvc (>=5.0.0.release, <=5.0.15.release)

org.springframework:spring-webmvc MAVEN version =5.0.0.release, =0.1.1, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =0.0.2, =0.0.3, =2.0.3.release, =2.0.2.release, =1.0.3.release, =2.0.0, =1.0.0, =1.0.0, =0.0.8-alpha, =0.0.17-alpha and more Source cves:...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=1.12.0), au.org.consumerdatastandards:data-holder (>=1.0.0, <=1.12.0) +1443 more potentially affected by CVE-2020-5398 via org.springframework:spring-webmvc (>=5.2.0.release, <=5.2.2.release)

org.springframework:spring-webmvc MAVEN version =5.2.0.release, =1.1.1, =1.0.0, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.1, =0.0.3 - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-igpacks 4.1.0 and...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.21) +3813 more potentially affected by CVE-2020-5398 via org.springframework:spring-webmvc (>=5.1.0.release, <=5.1.12.release)

org.springframework:spring-webmvc MAVEN version =5.1.0.release, =4.4.0.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr1, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 - ai.ylyue:yue-library-web 2.1.0 and more Source cves: CVE-2020-5398 Source...

Denial of service

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...

CVE-2018-15756

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...

CVE-2018-15756

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...