Medium · published May 13, 2022
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
| Product | Versions | Fixed in |
|---|---|---|
| vmware/spring_framework | ≤ 5.2.21 | — |
| vmware/spring_framework | ≥ 5.3.0, ≤ 5.3.19 | — |
| oracle/financial_services_crime_and_compliance_management_studio | all versions | — |
| oracle/financial_services_crime_and_compliance_management_studio | all versions | — |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/brocade_san_navigator | all versions | — |
| netapp/cloud_secure_agent | all versions | — |
| netapp/oncommand_insight | all versions | — |