| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework:spring-context | ≥ 6.0.0, ≤ 6.0.24≥ 6.1.0, < 6.1.14≤ 5.3.40 | 6.1.14 |
| org.springframework:spring-web | ≥ 6.0.0, ≤ 6.0.24≥ 6.1.0, < 6.1.14≤ 5.3.40 | 6.1.14 |
| spring framework | ≥ 5.3.0, < 5.3.41≥ 6.0.0, < 6.0.25≥ 6.1.0, < 6.1.14 | 5.3.416.0.256.1.14 |
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free