medium
5.3
CWE
117
Advisory Published
CVE Published
Advisory Published
Updated

CVE-2021-22096

First published: Thu Oct 28 2021(Updated: )

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

Credit: security@vmware.com security@vmware.com

Affected SoftwareAffected VersionHow to fix
redhat/ovirt-dependencies<0:4.5.2-1.el8e
0:4.5.2-1.el8e
VMware Spring Framework>=5.2.0<=5.2.17
VMware Spring Framework>=5.3.0<=5.3.10
Netapp Active Iq Unified Manager Linux
Netapp Active Iq Unified Manager Vsphere
Netapp Active Iq Unified Manager Windows
Netapp Management Services For Element Software And Netapp Hci
Netapp Metrocluster Tiebreaker Clustered Data Ontap
NetApp Snap Creator Framework
Netapp Snapcenter
Oracle Communications Cloud Native Core Console=1.9.0
Oracle Communications Cloud Native Core Service Communication Proxy=1.15.0
maven/org.springframework:spring>=5.3.0<=5.3.10
5.3.11
maven/org.springframework:spring>=5.2.0<=5.2.17
5.2.18
maven/org.springframework:spring-core>=5.2.0<=5.2.17
5.2.18
maven/org.springframework:spring-core>=5.3.0<=5.3.10
5.3.11
IBM QRadar SIEM<=7.5.0 GA
IBM QRadar SIEM<=7.4.3 GA - 7.4.3 FP4
IBM QRadar SIEM<=7.3.3 GA - 7.3.3 FP10

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is CVE-2021-22096?

    CVE-2021-22096 is a vulnerability in the Spring Framework that allows a remote attacker to bypass security restrictions and insert additional log entries.

  • What versions of the Spring Framework are affected by CVE-2021-22096?

    Versions 5.3.0 - 5.3.10 and 5.2.0 - 5.2.17 of the Spring Framework are affected.

  • How can an attacker exploit CVE-2021-22096?

    An attacker can exploit CVE-2021-22096 by sending a specially-crafted input to bypass security restrictions and insert additional log entries.

  • What is the severity of CVE-2021-22096?

    CVE-2021-22096 has a severity rating of medium.

  • Where can I find more information about CVE-2021-22096?

    You can find more information about CVE-2021-22096 on the VMware Security Advisory, Red Hat Bugzilla, and Red Hat Errata websites.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203