CVE-2021-22118
Improper Privilege Management in Spring Framework
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Record
CVE-2021-22118- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-269, CWE-668
- Updated
- 2026-11-02
CVE ListNo score
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Record
CVE-2021-22118- Weakness
- CWE-269
- Updated
- 2026-11-02
EUVDEUVD-2022-3947No score
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Record
EUVD-2022-3947- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gfwj-fwqj-fp3v
Improper Privilege Management in Spring Framework
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Record
GHSA-gfwj-fwqj-fp3v- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269, CWE-668
- Updated
- 2026-11-02
OSV
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Record
CVE-2021-22118- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-gfwj-fwqj-fp3v
Improper Privilege Management in Spring Framework
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Record
GHSA-gfwj-fwqj-fp3v- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269, CWE-668
- Updated
- 2026-11-02
Show 17 moreShow less
OSVUBUNTU-CVE-2021-22118
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Record
UBUNTU-CVE-2021-22118- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVCLSA-2025-1762906008No score
TuxCare security update for org.springframework (13 CVEs)
TuxCare rebuilt 10 org.springframework packages to address 13 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.1.
- Record
CLSA-2025-1762906008- Updated
- 2026-11-02
OSVCLSA-2026-1777855419No score
TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 6 org.springframework packages to address 6 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.2.
- Record
CLSA-2026-1777855419- Updated
- 2026-11-11
OSVCLSA-2026-1785030424No score
TuxCare security update for org.springframework (14 CVEs)
TuxCare rebuilt 9 org.springframework packages to address 14 CVEs. Fixed in 5.1.9.RELEASE-tuxcare.2.
- Record
CLSA-2026-1785030424- Updated
- 2026-11-02
OSVCLSA-2026-1785815205No score
TuxCare security update for org.springframework (23 CVEs)
TuxCare rebuilt 9 org.springframework packages to address 23 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.2.
- Record
CLSA-2026-1785815205- Updated
- 2026-11-02
OSVCLSA-2026-1785957662No score
TuxCare security update for org.springframework (7 CVEs)
TuxCare rebuilt 4 org.springframework packages to address 7 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.7.
- Record
CLSA-2026-1785957662- Updated
- 2026-11-02
OSVCLSA-2026-1787070801No score
TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 4 org.springframework packages to address 6 CVEs. Fixed in 5.1.20.RELEASE-tuxcare.4.
- Record
CLSA-2026-1787070801- Updated
- 2026-11-02
OSVCLSA-2026-1789380988No score
TuxCare security update for org.springframework (20 CVEs)
TuxCare rebuilt 10 org.springframework packages to address 20 CVEs. Fixed in 5.2.11.RELEASE-tuxcare.1.
- Record
CLSA-2026-1789380988- Updated
- 2026-11-02
OSVCLSA-2026-1790857021No score
TuxCare security update for org.springframework (25 CVEs)
TuxCare rebuilt 9 org.springframework packages to address 25 CVEs. Fixed in 5.1.18.RELEASE-tuxcare.1.
- Record
CLSA-2026-1790857021- Updated
- 2026-11-02
OSVCLSA-2026-1792687946No score
TuxCare security update for org.springframework:spring-web (1 CVE)
TuxCare rebuilt org.springframework:spring-web to address 1 CVE. Fixed in 5.1.19.RELEASE-tuxcare.2.
- Record
CLSA-2026-1792687946- Updated
- 2026-11-02
OSVCLSA-2026-1793105396No score
TuxCare security update for org.springframework (2 CVEs)
TuxCare rebuilt 2 org.springframework packages to address 2 CVEs. Fixed in 5.1.7.RELEASE-tuxcare.2.
- Record
CLSA-2026-1793105396- Updated
- 2026-11-02
OSVCLSA-2026-1793620971No score
TuxCare security update for org.springframework (13 CVEs)
TuxCare rebuilt 8 org.springframework packages to address 13 CVEs. Fixed in 5.2.10.RELEASE-tuxcare.3.
- Record
CLSA-2026-1793620971- Updated
- 2026-11-02
OSVCLSA-2026-1793897973No score
TuxCare security update for org.springframework (10 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 10 CVEs. Fixed in 5.1.8.RELEASE-tuxcare.2.
- Record
CLSA-2026-1793897973- Updated
- 2026-11-06
OSVCLSA-2026-1793901658No score
TuxCare security update for org.springframework (2 CVEs)
TuxCare rebuilt 2 org.springframework packages to address 2 CVEs. Fixed in 5.1.13.RELEASE-tuxcare.3.
- Record
CLSA-2026-1793901658- Updated
- 2026-11-06
OSVCLSA-2026-1794378394No score
TuxCare security update for org.springframework:spring-web (1 CVE)
TuxCare rebuilt org.springframework:spring-web to address 1 CVE. Fixed in 5.2.7.RELEASE-tuxcare.5.
- Record
CLSA-2026-1794378394- Updated
- 2026-11-11
OSVCLSA-2026-1794378927No score
TuxCare security update for org.springframework:spring-web (1 CVE)
TuxCare rebuilt org.springframework:spring-web to address 1 CVE. Fixed in 5.2.9.RELEASE-tuxcare.5.
- Record
CLSA-2026-1794378927- Updated
- 2026-11-11
OSVCLSA-2026-1794383183No score
TuxCare security update for org.springframework:spring-web (1 CVE)
TuxCare rebuilt org.springframework:spring-web to address 1 CVE. Fixed in 5.2.8.RELEASE-tuxcare.4.
- Record
CLSA-2026-1794383183- Updated
- 2026-11-11
Affected products
- vmware spring framework
- netapp hci
- netapp management services for element software
- oracle commerce guided search
- oracle communications brm - elastic charging engine
- oracle communications cloud native core binding support function
- oracle communications cloud native core policy
- oracle communications cloud native core security edge protection proxy
- oracle communications cloud native core service communication proxy
- oracle communications cloud native core unified data repository
- oracle communications diameter intelligence hub
- oracle communications element manager
Show 20 moreShow less
- oracle communications interactive session recorder
- oracle communications network integrity
- oracle communications session report manager
- oracle communications session route manager
- oracle communications unified inventory management
- oracle documaker
- oracle enterprise data quality
- oracle financial services analytical applications infrastructure
- oracle healthcare data repository
- oracle insurance policy administration
- oracle insurance rules palette
- oracle mysql enterprise monitor
- oracle retail assortment planning
- oracle retail customer management and segmentation foundation
- oracle retail financial integration
- oracle retail integration bus
- oracle retail merchandising system
- oracle retail order broker
- oracle retail predictive application server
- oracle utilities testing accelerator
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webMaven | 5.2.0 to 5.2.14 | 5.2.15 |
org.springframework:spring-webMaven | 5.3.0 to 5.3.6 | 5.3.7 |
org.springframework:springTuxCare:Maven From an advisory covering 13 CVEs | 5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 13 CVEs | 5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 13 CVEs | 5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 13 CVEs | 5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 13 CVEs | 5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-framework-bomTuxCare:Maven From an advisory covering 13 CVEs | 5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 13 CVEs | 5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 13 CVEs | 5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
Show 76 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 13 CVEs | 5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 13 CVEs | 5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 6 CVEs | 5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.2, plus listed versions 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.2 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 6 CVEs | 5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.2, plus listed versions 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 6 CVEs | 5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.2, plus listed versions 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 6 CVEs | 5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.2, plus listed versions 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 6 CVEs | 5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.2, plus listed versions 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 6 CVEs | 5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.2, plus listed versions 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-framework-bomTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 23 CVEs | 5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 23 CVEs | 5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 23 CVEs | 5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 23 CVEs | 5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-framework-bomTuxCare:Maven From an advisory covering 23 CVEs | 5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 23 CVEs | 5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 23 CVEs | 5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 23 CVEs | 5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 23 CVEs | 5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 7 CVEs | 5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 | 5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 7 CVEs | 5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 | 5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 7 CVEs | 5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 | 5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 7 CVEs | 5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 | 5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 6 CVEs | 5.1.20.RELEASE up to 5.1.20.RELEASE-tuxcare.4, plus listed versions 5.1.20.RELEASE-tuxcare.15.1.20.RELEASE-tuxcare.25.1.20.RELEASE-tuxcare.3 | 5.1.20.RELEASE-tuxcare.4 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 6 CVEs | 5.1.20.RELEASE up to 5.1.20.RELEASE-tuxcare.4, plus listed versions 5.1.20.RELEASE-tuxcare.15.1.20.RELEASE-tuxcare.25.1.20.RELEASE-tuxcare.3 | 5.1.20.RELEASE-tuxcare.4 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 6 CVEs | 5.1.20.RELEASE up to 5.1.20.RELEASE-tuxcare.4, plus listed versions 5.1.20.RELEASE-tuxcare.15.1.20.RELEASE-tuxcare.25.1.20.RELEASE-tuxcare.3 | 5.1.20.RELEASE-tuxcare.4 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 6 CVEs | 5.1.20.RELEASE up to 5.1.20.RELEASE-tuxcare.4, plus listed versions 5.1.20.RELEASE-tuxcare.15.1.20.RELEASE-tuxcare.25.1.20.RELEASE-tuxcare.3 | 5.1.20.RELEASE-tuxcare.4 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 20 CVEs | 5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 20 CVEs | 5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 20 CVEs | 5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 20 CVEs | 5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 20 CVEs | 5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 20 CVEs | 5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 20 CVEs | 5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 20 CVEs | 5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 20 CVEs | 5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 20 CVEs | 5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 25 CVEs | 5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 25 CVEs | 5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 25 CVEs | 5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 25 CVEs | 5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-framework-bomTuxCare:Maven From an advisory covering 25 CVEs | 5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 25 CVEs | 5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 25 CVEs | 5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 25 CVEs | 5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 25 CVEs | 5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven | 5.1.19.RELEASE up to 5.1.19.RELEASE-tuxcare.2, plus listed versions 5.1.19.RELEASE-tuxcare.1 | 5.1.19.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 2 CVEs | 5.1.7.RELEASE up to 5.1.7.RELEASE-tuxcare.2, plus listed versions 5.1.7.RELEASE-tuxcare.1 | 5.1.7.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 2 CVEs | 5.1.7.RELEASE up to 5.1.7.RELEASE-tuxcare.2, plus listed versions 5.1.7.RELEASE-tuxcare.1 | 5.1.7.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 13 CVEs | 5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 | 5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 13 CVEs | 5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 | 5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 13 CVEs | 5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 | 5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 13 CVEs | 5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 | 5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-framework-bomTuxCare:Maven From an advisory covering 13 CVEs | 5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 | 5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 13 CVEs | 5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 | 5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 13 CVEs | 5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 | 5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 13 CVEs | 5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 | 5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 10 CVEs | 5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 | 5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 10 CVEs | 5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 | 5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 10 CVEs | 5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 | 5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 10 CVEs | 5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 | 5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 10 CVEs | 5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 | 5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 2 CVEs | 5.1.13.RELEASE up to 5.1.13.RELEASE-tuxcare.3, plus listed versions 5.1.13.RELEASE-tuxcare.15.1.13.RELEASE-tuxcare.2 | 5.1.13.RELEASE-tuxcare.3 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 2 CVEs | 5.1.13.RELEASE up to 5.1.13.RELEASE-tuxcare.3, plus listed versions 5.1.13.RELEASE-tuxcare.15.1.13.RELEASE-tuxcare.2 | 5.1.13.RELEASE-tuxcare.3 |
org.springframework:spring-webTuxCare:Maven | 5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.5, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.25.2.7.RELEASE-tuxcare.35.2.7.RELEASE-tuxcare.4 | 5.2.7.RELEASE-tuxcare.5 |
org.springframework:spring-webTuxCare:Maven | 5.2.9.RELEASE up to 5.2.9.RELEASE-tuxcare.5, plus listed versions 5.2.9.RELEASE-tuxcare.15.2.9.RELEASE-tuxcare.25.2.9.RELEASE-tuxcare.35.2.9.RELEASE-tuxcare.4 | 5.2.9.RELEASE-tuxcare.5 |
org.springframework:spring-webTuxCare:Maven | 5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.4, plus listed versions 5.2.8.RELEASE-tuxcare.15.2.8.RELEASE-tuxcare.25.2.8.RELEASE-tuxcare.3 | 5.2.8.RELEASE-tuxcare.4 |
org.springframework:spring-webMaven | 5.2.0 up to 5.2.15, plus listed versions 5.2.0.RELEASE5.2.1.RELEASE5.2.10.RELEASE5.2.11.RELEASE5.2.12.RELEASE Show 10 moreShow less5.2.13.RELEASE5.2.14.RELEASE5.2.2.RELEASE5.2.3.RELEASE5.2.4.RELEASE5.2.5.RELEASE5.2.6.RELEASE5.2.7.RELEASE5.2.8.RELEASE5.2.9.RELEASE | 5.2.15 |
org.springframework:spring-webMaven | 5.3.0 up to 5.3.7, plus listed versions 5.3.15.3.25.3.35.3.45.3.55.3.6 | 5.3.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, aliases | OSV | |
| affected, aliases | OSV | |
| affected | ||
| affected, facts | OSV | |
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-22118 is a high vulnerability (CVSS 7.8) in Vmware Spring Framework, published May 27, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in org.springframework:spring-web 5.2.15.
References
tanzu.vmware.com/security/cve-2021-22118
oracle.com//security-alerts/cpujul2021.html
security.netapp.com/advisory/ntap-20210713-0005
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-22118
github.com/spring-projects/spring-framework/issues/26931
spring.io/security/cve-2021-22118
ubuntu.com/security/CVE-2021-22118
cve.org/CVERecord?id=CVE-2021-22118