#VU62314 Security features bypass in Pivotal Spring Framework - CVE-2022-22968
Published: April 14, 2022 / Updated: May 12, 2022
Vulnerability identifier: #VU62314
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2022-22968
CWE-ID: CWE-254
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
Pivotal Spring Framework
Pivotal Spring Framework
Software vendor:
Pivotal
Pivotal
Description
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to patterns for disallowedFields on a DataBinder are case sensitive, which means a field is not effectively protected unless it is listed
with both upper and lower case for the first character of the field,
including upper and lower case for the first character of all nested
fields within the property path. A remote attacker can bypass implemented security restrictions by passing case sensitive data to the application.
Remediation
Install updates from vendor's website.