Security features bypass in Pivotal Spring Framework - CVE-2022-22968
Published: April 14, 2022 / Updated: May 12, 2022
Vulnerability identifier: #VU62314
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2022-22968
CWE-ID: CWE-254
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vendor: Pivotal
Affected software:
Pivotal Spring Framework
Pivotal Spring Framework
Detailed vulnerability description
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to patterns for disallowedFields on a DataBinder are case sensitive, which means a field is not effectively protected unless it is listed
with both upper and lower case for the first character of the field,
including upper and lower case for the first character of all nested
fields within the property path. A remote attacker can bypass implemented security restrictions by passing case sensitive data to the application.
How to mitigate CVE-2022-22968
Install updates from vendor's website.