要点
- CVE-2021-22118 は org.springframework:spring-web, commerce guided search (oracle), communications brm - elastic charging engine (oracle) に影響する深刻度「高」 (CVSS 7.8) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.38%（全脆弱性の 32.1% より高い）。
- 対処：5.2.15, 5.3.7 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| org.springframework:spring-web Maven | ≥ 5.2.0, < 5.2.15≥ 5.3.0, < 5.3.7
| 5.2.155.3.7
|
| commerce guided search | = 11.3.2
| 修正版なし |
| communications brm - elastic charging engine | = 12.0.0.3
| 修正版なし |
| communications cloud native core binding support function | = 1.9.0
| 修正版なし |
| communications cloud native core policy | = 1.14.0
| 修正版なし |
| communications cloud native core security edge protection proxy | = 1.6.0
| 修正版なし |
| communications cloud native core service communication proxy | = 1.14.0
| 修正版なし |
| communications cloud native core unified data repository | = 1.14.0
| 修正版なし |
| communications diameter intelligence hub | ≥ 8.0.0, ≤ 8.1.0≥ 8.2.0, ≤ 8.2.3
| 修正版なし |
| communications element manager | ≥ 8.2.0, ≤ 8.2.4.0
| 修正版なし |
| communications interactive session recorder | = 6.4
| 修正版なし |
| communications network integrity | = 7.3.6
| 修正版なし |
| communications session report manager | ≥ 8.0.0, ≤ 8.2.4.0
| 修正版なし |
| communications session route manager | ≥ 8.0.0, ≤ 8.2.4.0
| 修正版なし |
| communications unified inventory management | = 7.4.1= 7.4.2= 7.5.0
| 修正版なし |
| documaker | ≥ 12.6.0, ≤ 12.6.4
| 修正版なし |
| enterprise data quality | = 12.2.1.3.0= 12.2.1.4.0
| 修正版なし |
| financial services analytical applications infrastructure | ≥ 8.0.8, ≤ 8.1.1
| 修正版なし |
| healthcare data repository | = 8.1.0
| 修正版なし |
| insurance policy administration | ≥ 11.0, ≤ 11.3.1
| 修正版なし |
| insurance rules palette | = 11.0.2= 11.1.0= 11.2.7= 11.3.0= 11.3.1
| 修正版なし |
| mysql enterprise monitor | ≤ 8.0.25
| 修正版なし |
| retail assortment planning | = 16.0
| 修正版なし |
| retail customer management and segmentation foundation | ≥ 16.0, ≤ 19.0
| 修正版なし |
| retail financial integration | = 14.1.3.2= 15.0.3.1= 16.0.3
| 修正版なし |
| retail integration bus | = 14.1.3.2= 15.0.3.1= 16.0.3
| 修正版なし |
| retail merchandising system | = 19.0.1
| 修正版なし |
| retail order broker | = 16.0
| 修正版なし |
| retail predictive application server | = 14.1.3= 15.0.3= 16.0.3
| 修正版なし |
| utilities testing accelerator | = 6.0.0.1.1= 6.0.0.2.2= 6.0.0.3.1
| 修正版なし |
| spring framework | ≥ 5.2.0, < 5.2.15≥ 5.3.0, < 5.3.7
| 5.2.155.3.7
|
概要
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
NVD の説明
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
org.springframework:spring-web のその他の脆弱性
すべて見る →これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン