CVE-2021-22118
Improper Privilege Management in Spring Framework
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Record
CVE-2021-22118- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-269, CWE-668
- Updated
- 2026-11-02
CVE List No score
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Record
CVE-2021-22118- Weakness
- CWE-269
- Updated
- 2026-11-02
EUVDEUVD-2022-3947 No score
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Record
EUVD-2022-3947- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gfwj-fwqj-fp3v
Improper Privilege Management in Spring Framework
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Record
GHSA-gfwj-fwqj-fp3v- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269, CWE-668
- Updated
- 2026-11-02
OSV
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Record
CVE-2021-22118- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-gfwj-fwqj-fp3v
Improper Privilege Management in Spring Framework
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Record
GHSA-gfwj-fwqj-fp3v- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269, CWE-668
- Updated
- 2026-11-02
Show 13 moreShow less
OSVUBUNTU-CVE-2021-22118
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Record
UBUNTU-CVE-2021-22118- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVCLSA-2025-1762906008 No score
TuxCare security update for org.springframework (13 CVEs)
TuxCare rebuilt 10 org.springframework packages to address 13 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.1.
- Record
CLSA-2025-1762906008- Updated
- 2026-11-02
OSVCLSA-2026-1785030424 No score
TuxCare security update for org.springframework (14 CVEs)
TuxCare rebuilt 9 org.springframework packages to address 14 CVEs. Fixed in 5.1.9.RELEASE-tuxcare.2.
- Record
CLSA-2026-1785030424- Updated
- 2026-11-02
OSVCLSA-2026-1785815205 No score
TuxCare security update for org.springframework (23 CVEs)
TuxCare rebuilt 9 org.springframework packages to address 23 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.2.
- Record
CLSA-2026-1785815205- Updated
- 2026-11-02
OSVCLSA-2026-1785957662 No score
TuxCare security update for org.springframework (7 CVEs)
TuxCare rebuilt 4 org.springframework packages to address 7 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.7.
- Record
CLSA-2026-1785957662- Updated
- 2026-11-02
OSVCLSA-2026-1787070801 No score
TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 4 org.springframework packages to address 6 CVEs. Fixed in 5.1.20.RELEASE-tuxcare.4.
- Record
CLSA-2026-1787070801- Updated
- 2026-11-02
OSVCLSA-2026-1789380988 No score
TuxCare security update for org.springframework (20 CVEs)
TuxCare rebuilt 10 org.springframework packages to address 20 CVEs. Fixed in 5.2.11.RELEASE-tuxcare.1.
- Record
CLSA-2026-1789380988- Updated
- 2026-11-02
OSVCLSA-2026-1790857021 No score
TuxCare security update for org.springframework (25 CVEs)
TuxCare rebuilt 9 org.springframework packages to address 25 CVEs. Fixed in 5.1.18.RELEASE-tuxcare.1.
- Record
CLSA-2026-1790857021- Updated
- 2026-11-02
OSVCLSA-2026-1792687946 No score
TuxCare security update for org.springframework:spring-web (1 CVE)
TuxCare rebuilt org.springframework:spring-web to address 1 CVE. Fixed in 5.1.19.RELEASE-tuxcare.2.
- Record
CLSA-2026-1792687946- Updated
- 2026-11-02
OSVCLSA-2026-1793105396 No score
TuxCare security update for org.springframework (2 CVEs)
TuxCare rebuilt 2 org.springframework packages to address 2 CVEs. Fixed in 5.1.7.RELEASE-tuxcare.2.
- Record
CLSA-2026-1793105396- Updated
- 2026-11-02
OSVCLSA-2026-1793620971 No score
TuxCare security update for org.springframework (13 CVEs)
TuxCare rebuilt 8 org.springframework packages to address 13 CVEs. Fixed in 5.2.10.RELEASE-tuxcare.3.
- Record
CLSA-2026-1793620971- Updated
- 2026-11-02
OSVCLSA-2026-1793897973 No score
TuxCare security update for org.springframework (10 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 10 CVEs. Fixed in 5.1.8.RELEASE-tuxcare.2.
- Record
CLSA-2026-1793897973- Updated
- 2026-11-06
OSVCLSA-2026-1793901658 No score
TuxCare security update for org.springframework (2 CVEs)
TuxCare rebuilt 2 org.springframework packages to address 2 CVEs. Fixed in 5.1.13.RELEASE-tuxcare.3.
- Record
CLSA-2026-1793901658- Updated
- 2026-11-06
Affected products
- vmware spring framework
- netapp hci
- netapp management services for element software
- oracle commerce guided search
- oracle communications brm - elastic charging engine
- oracle communications cloud native core binding support function
- oracle communications cloud native core policy
- oracle communications cloud native core security edge protection proxy
- oracle communications cloud native core service communication proxy
- oracle communications cloud native core unified data repository
- oracle communications diameter intelligence hub
- oracle communications element manager
Show 20 moreShow less
- oracle communications interactive session recorder
- oracle communications network integrity
- oracle communications session report manager
- oracle communications session route manager
- oracle communications unified inventory management
- oracle documaker
- oracle enterprise data quality
- oracle financial services analytical applications infrastructure
- oracle healthcare data repository
- oracle insurance policy administration
- oracle insurance rules palette
- oracle mysql enterprise monitor
- oracle retail assortment planning
- oracle retail customer management and segmentation foundation
- oracle retail financial integration
- oracle retail integration bus
- oracle retail merchandising system
- oracle retail order broker
- oracle retail predictive application server
- oracle utilities testing accelerator
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webMaven |
5.2.0 to 5.2.14 | 5.2.15 |
org.springframework:spring-webMaven |
5.3.0 to 5.3.6 | 5.3.7 |
org.springframework:springTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-framework-bomTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
Show 67 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-framework-bomTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 23 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 |
5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 23 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 |
5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 23 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 |
5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 23 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 |
5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-framework-bomTuxCare:Maven From an advisory covering 23 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 |
5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 23 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 |
5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 23 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 |
5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 23 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 |
5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 23 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.2, plus listed versions 5.1.6.RELEASE-tuxcare.1 |
5.1.6.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 7 CVEs |
5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 |
5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 7 CVEs |
5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 |
5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 7 CVEs |
5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 |
5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 7 CVEs |
5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 |
5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 6 CVEs |
5.1.20.RELEASE up to 5.1.20.RELEASE-tuxcare.4, plus listed versions 5.1.20.RELEASE-tuxcare.15.1.20.RELEASE-tuxcare.25.1.20.RELEASE-tuxcare.3 |
5.1.20.RELEASE-tuxcare.4 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 6 CVEs |
5.1.20.RELEASE up to 5.1.20.RELEASE-tuxcare.4, plus listed versions 5.1.20.RELEASE-tuxcare.15.1.20.RELEASE-tuxcare.25.1.20.RELEASE-tuxcare.3 |
5.1.20.RELEASE-tuxcare.4 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 6 CVEs |
5.1.20.RELEASE up to 5.1.20.RELEASE-tuxcare.4, plus listed versions 5.1.20.RELEASE-tuxcare.15.1.20.RELEASE-tuxcare.25.1.20.RELEASE-tuxcare.3 |
5.1.20.RELEASE-tuxcare.4 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 6 CVEs |
5.1.20.RELEASE up to 5.1.20.RELEASE-tuxcare.4, plus listed versions 5.1.20.RELEASE-tuxcare.15.1.20.RELEASE-tuxcare.25.1.20.RELEASE-tuxcare.3 |
5.1.20.RELEASE-tuxcare.4 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 20 CVEs |
5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 20 CVEs |
5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 20 CVEs |
5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 20 CVEs |
5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 20 CVEs |
5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 20 CVEs |
5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 20 CVEs |
5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 20 CVEs |
5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 20 CVEs |
5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 20 CVEs |
5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.1 | 5.2.11.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 25 CVEs |
5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 25 CVEs |
5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 25 CVEs |
5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 25 CVEs |
5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-framework-bomTuxCare:Maven From an advisory covering 25 CVEs |
5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 25 CVEs |
5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 25 CVEs |
5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 25 CVEs |
5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 25 CVEs |
5.1.18.RELEASE up to 5.1.18.RELEASE-tuxcare.1 | 5.1.18.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven |
5.1.19.RELEASE up to 5.1.19.RELEASE-tuxcare.2, plus listed versions 5.1.19.RELEASE-tuxcare.1 |
5.1.19.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 2 CVEs |
5.1.7.RELEASE up to 5.1.7.RELEASE-tuxcare.2, plus listed versions 5.1.7.RELEASE-tuxcare.1 |
5.1.7.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 2 CVEs |
5.1.7.RELEASE up to 5.1.7.RELEASE-tuxcare.2, plus listed versions 5.1.7.RELEASE-tuxcare.1 |
5.1.7.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 13 CVEs |
5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 |
5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 13 CVEs |
5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 |
5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 13 CVEs |
5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 |
5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 13 CVEs |
5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 |
5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-framework-bomTuxCare:Maven From an advisory covering 13 CVEs |
5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 |
5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 13 CVEs |
5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 |
5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 13 CVEs |
5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 |
5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 13 CVEs |
5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2 |
5.2.10.RELEASE-tuxcare.3 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 2 CVEs |
5.1.13.RELEASE up to 5.1.13.RELEASE-tuxcare.3, plus listed versions 5.1.13.RELEASE-tuxcare.15.1.13.RELEASE-tuxcare.2 |
5.1.13.RELEASE-tuxcare.3 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 2 CVEs |
5.1.13.RELEASE up to 5.1.13.RELEASE-tuxcare.3, plus listed versions 5.1.13.RELEASE-tuxcare.15.1.13.RELEASE-tuxcare.2 |
5.1.13.RELEASE-tuxcare.3 |
org.springframework:spring-webMaven |
5.2.0 up to 5.2.15, plus listed versions 5.2.0.RELEASE5.2.1.RELEASE5.2.10.RELEASE5.2.11.RELEASE5.2.12.RELEASE Show 10 moreShow less5.2.13.RELEASE5.2.14.RELEASE5.2.2.RELEASE5.2.3.RELEASE5.2.4.RELEASE5.2.5.RELEASE5.2.6.RELEASE5.2.7.RELEASE5.2.8.RELEASE5.2.9.RELEASE |
5.2.15 |
org.springframework:spring-webMaven |
5.3.0 up to 5.3.7, plus listed versions 5.3.15.3.25.3.35.3.45.3.55.3.6 |
5.3.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected | ||
| affected, facts | OSV | |
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-22118 is a high vulnerability (CVSS 7.8) in Vmware Spring Framework, published May 27, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in org.springframework:spring-web 5.2.15.
References
tanzu.vmware.com/security/cve-2021-22118
oracle.com//security-alerts/cpujul2021.html
security.netapp.com/advisory/ntap-20210713-0005
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-22118
github.com/spring-projects/spring-framework/issues/26931
spring.io/security/cve-2021-22118
ubuntu.com/security/CVE-2021-22118
cve.org/CVERecord?id=CVE-2021-22118