QwikSec

Security Database

CVE

CWE

Training

CVE-2022-22970

Published: May 12, 2022

Modified: Aug 3, 2024

PUBLISHED

Description

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

Vendor	Product	Versions
n/a	Spring Framework	affected `Spring Framework versions 5.3.x prior to 5.3.20, 5.2.x prior to 5.2.22 and all old and unsupported versions`

Weaknesses (CWE)

References

https://tanzu.vmware.com/security/cve-2022-22970

x_refsource_MISC

https://www.oracle.com/security-alerts/cpujul2022.html

x_refsource_MISC

https://security.netapp.com/advisory/ntap-20220616-0006/

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.