Improper Control of Generation of Code ('Code Injection') in Spring Framework

中危 6.0CVE-2010-1622 · GHSA-vpr3-f594-mg5g · Published 21/06/2010 · updated 16/06/2026

要点

CVE-2010-1622 是影响 org.springframework:spring, fusion middleware (oracle), spring framework (springsource) 的中危 (CVSS 6.0)漏洞。
未来 30 天内被利用的概率（EPSS）：52.0%，高于 99.0% 的漏洞。
修复：升级到 2.5.7, 3.0.3 或更高版本。

Package	Affected versions	Patched versions
org.springframework:spring Maven	`≥ 2.5.0, < 2.5.7≥ 3.0.0, < 3.0.3`	`2.5.73.0.3`
fusion middleware oracle	`= 11.1.1.6.1= 11.1.1.8.0= 7.6.2`	No fix yet
spring framework springsource	`= 2.5.0= 2.5.1= 2.5.2= 2.5.3= 2.5.4= 2.5.5= 2.5.6= 2.5.7= 3.0.0= 3.0.1= 3.0.2`	No fix yet

Description

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

NVD description

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

References

org.springframework:spring 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free