CVE-2022-22970
springframework: DoS via data binding to multipartFile or servlet part
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
En spring Framework versiones anteriores a 5.3.20+ , 5.2.22+ y las versiones antiguas no soportadas, las aplicaciones que manejan cargas de archivos son vulnerables a un ataque de denegación de servicio si dependen de la vinculación de datos para establecer un MultipartFile o javax.servlet.Part a un campo en un objeto modelo
A flaw was found in Spring Framework. Applications that handle file uploads are vulnerable to a denial of service (DoS) attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms. This release of Red Hat AMQ Broker 7.11.0 includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section. Issues addressed include denial of service, information leakage, and traversal vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-01-10 CVE Reserved
- 2022-05-12 CVE Published
- 2024-08-03 CVE Updated
- 2024-11-22 First Exploit
- 2025-04-02 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20220616-0006 | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/Performant-Labs/CVE-2022-22970 | 2024-11-22 |
| URL | Date | SRC |
|---|---|---|
| https://www.oracle.com/security-alerts/cpujul2022.html | 2022-10-07 |
| URL | Date | SRC |
|---|---|---|
| https://tanzu.vmware.com/security/cve-2022-22970 | 2022-10-07 | |
| https://access.redhat.com/security/cve/CVE-2022-22970 | 2023-05-17 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2087272 | 2023-05-17 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | <= 5.2.21 Search vendor "Vmware" for product "Spring Framework" and version " <= 5.2.21" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | >= 5.3.0 <= 5.3.19 Search vendor "Vmware" for product "Spring Framework" and version " >= 5.3.0 <= 5.3.19" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Financial Services Crime And Compliance Management Studio Search vendor "Oracle" for product "Financial Services Crime And Compliance Management Studio" | 8.0.8.2.0 Search vendor "Oracle" for product "Financial Services Crime And Compliance Management Studio" and version "8.0.8.2.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Financial Services Crime And Compliance Management Studio Search vendor "Oracle" for product "Financial Services Crime And Compliance Management Studio" | 8.0.8.3.0 Search vendor "Oracle" for product "Financial Services Crime And Compliance Management Studio" and version "8.0.8.3.0" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | - | linux |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | - | vmware_vsphere |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | - | windows |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Brocade San Navigator Search vendor "Netapp" for product "Brocade San Navigator" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Cloud Secure Agent Search vendor "Netapp" for product "Cloud Secure Agent" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Oncommand Insight Search vendor "Netapp" for product "Oncommand Insight" | - | - |
Affected
| ||||||