GHSA-rfmp-97jj-h8m6MediumCVSS 4.3

Improper Output Neutralization for Logs in Spring Framework

Published
May 24, 2022
Last Modified
July 19, 2024

🔗 CVE IDs covered (1)

CVE-2021-22096 →

📋 Description

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

🎯 Affected products4

  • maven/org.springframework:spring-core:>= 5.3.0, <= 5.3.10
  • maven/org.springframework:spring-core:>= 5.2.0, <= 5.2.17
  • maven/org.springframework:spring:>= 5.2.0, <= 5.2.17
  • maven/org.springframework:spring:>= 5.3.0, <= 5.3.10

🔗 References (5)