CVE-2022-22971CWE-770denial-of-service

CVE-2022-22971

Medium · published May 13, 2022

CVSS v3.1

6.5

EPSS

Percentile

88.0

In the wild

Unconfirmed

What it is

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.03174 · 88.0th percentile
Weakness: CWE-770 · Allocation of Resources Without Limits or Throttling
Published: 2022-05-13T00:15Z

Affected products (6)

Product	Versions	Fixed in
vmware/spring_framework	≥ 5.2.0, ≤ 5.2.21	—
vmware/spring_framework	≥ 5.3.0, ≤ 5.3.19	—
oracle/financial_services_crime_and_compliance_management_studio	all versions	—
oracle/financial_services_crime_and_compliance_management_studio	all versions	—
netapp/cloud_secure_agent	all versions	—
netapp/oncommand_insight	all versions	—

References (6)

https://security.netapp.com/advisory/ntap-20220616-0003/ · [email protected]https://tanzu.vmware.com/security/cve-2022-22971 · [email protected]https://www.oracle.com/security-alerts/cpujul2022.html · [email protected]https://security.netapp.com/advisory/ntap-20220616-0003/ · af854a3a-2127-422b-91ae-364da2661108 https://tanzu.vmware.com/security/cve-2022-22971 · af854a3a-2127-422b-91ae-364da2661108 https://www.oracle.com/security-alerts/cpujul2022.html · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

12 MAY 19:30Z
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a…
cvelistv5