Input validation error in Spring Framework - CVE-2024-22233

Vulnerability identifier: #VU85846

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-22233

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send specially crafted HTTP requests to the application and perform a denial of service (DoS) attack.

Spring Framework
Oracle SD-WAN Edge
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Network Data Analytics Function
IBM Sterling Control Center
IBM Observability with Instana
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Security Edge Protection Proxy

Install updates from vendor's website.

Spring Framework - addressed in versions 6.0.16, 6.1.3
IBM Sterling Control Center - update to 6.3.1.0.2
IBM Observability with Instana - update to 271

• https://spring.io/security/cve-2024-22233

• Denial of service in Spring Framework
• Multiple vulnerabilities in Oracle SD-WAN Edge
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Data Analytics Function
• Multiple vulnerabilities in IBM Observability with Instana
• Input validation error in IBM Sterling Control Center