Exposure of Resource to Wrong Sphere in Spring Cloud OpenFeign

ALTO 7.5CVE-2021-22044 · GHSA-pf94-6v2v-cm3j · Published 28/10/2021 · updated 17/06/2026

In breve

CVE-2021-22044 è una vulnerabilità ALTO (CVSS 7.5) che riguarda org.springframework.cloud:spring-cloud-openfeign-core, spring cloud openfeign (vmware).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 65.7% delle vulnerabilità.
Correzione: aggiornare a 2.2.10, 3.0.5 o successiva.

Package	Affected versions	Patched versions
org.springframework.cloud:spring-cloud-openfeign-core Maven	`≥ 2.2.0, < 2.2.10≥ 3.0.0, < 3.0.5`	`2.2.103.0.5`
spring cloud openfeign vmware	`≥ 2.2.0, ≤ 2.2.9≥ 3.0.0, ≤ 3.0.4`	No fix yet

Description

In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level @RequestMappingannotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to @RequestMapping-annotated interface methods.

NVD description

In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@RequestMapping`annotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to `@RequestMapping`-annotated interface methods.

References

nvd.nist.gov/vuln/detail/CVE-2021-22044 · ADVISORY
tanzu.vmware.com/security/cve-2021-22044 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free