En resumen
- CVE-2021-22118 es una vulnerabilidad ALTO (CVSS 7.8) que afecta a org.springframework:spring-web, commerce guided search (oracle), communications brm - elastic charging engine (oracle).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.38%, mayor que el 32.1% de las vulnerabilidades.
- Solución: actualizar a 5.2.15, 5.3.7 o posterior.
| Package | Affected versions | Patched versions |
|---|
| org.springframework:spring-web Maven | ≥ 5.2.0, < 5.2.15≥ 5.3.0, < 5.3.7
| 5.2.155.3.7
|
| commerce guided search | = 11.3.2
| No fix yet |
| communications brm - elastic charging engine | = 12.0.0.3
| No fix yet |
| communications cloud native core binding support function | = 1.9.0
| No fix yet |
| communications cloud native core policy | = 1.14.0
| No fix yet |
| communications cloud native core security edge protection proxy | = 1.6.0
| No fix yet |
| communications cloud native core service communication proxy | = 1.14.0
| No fix yet |
| communications cloud native core unified data repository | = 1.14.0
| No fix yet |
| communications diameter intelligence hub | ≥ 8.0.0, ≤ 8.1.0≥ 8.2.0, ≤ 8.2.3
| No fix yet |
| communications element manager | ≥ 8.2.0, ≤ 8.2.4.0
| No fix yet |
| communications interactive session recorder | = 6.4
| No fix yet |
| communications network integrity | = 7.3.6
| No fix yet |
| communications session report manager | ≥ 8.0.0, ≤ 8.2.4.0
| No fix yet |
| communications session route manager | ≥ 8.0.0, ≤ 8.2.4.0
| No fix yet |
| communications unified inventory management | = 7.4.1= 7.4.2= 7.5.0
| No fix yet |
| documaker | ≥ 12.6.0, ≤ 12.6.4
| No fix yet |
| enterprise data quality | = 12.2.1.3.0= 12.2.1.4.0
| No fix yet |
| financial services analytical applications infrastructure | ≥ 8.0.8, ≤ 8.1.1
| No fix yet |
| healthcare data repository | = 8.1.0
| No fix yet |
| insurance policy administration | ≥ 11.0, ≤ 11.3.1
| No fix yet |
| insurance rules palette | = 11.0.2= 11.1.0= 11.2.7= 11.3.0= 11.3.1
| No fix yet |
| mysql enterprise monitor | ≤ 8.0.25
| No fix yet |
| retail assortment planning | = 16.0
| No fix yet |
| retail customer management and segmentation foundation | ≥ 16.0, ≤ 19.0
| No fix yet |
| retail financial integration | = 14.1.3.2= 15.0.3.1= 16.0.3
| No fix yet |
| retail integration bus | = 14.1.3.2= 15.0.3.1= 16.0.3
| No fix yet |
| retail merchandising system | = 19.0.1
| No fix yet |
| retail order broker | = 16.0
| No fix yet |
| retail predictive application server | = 14.1.3= 15.0.3= 16.0.3
| No fix yet |
| utilities testing accelerator | = 6.0.0.1.1= 6.0.0.2.2= 6.0.0.3.1
| No fix yet |
| spring framework | ≥ 5.2.0, < 5.2.15≥ 5.3.0, < 5.3.7
| 5.2.155.3.7
|
Description
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
NVD description
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
Más vulnerabilidades de org.springframework:spring-web
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free