VDB

CVE-2021-22060

CVE-2021-22060 PUBLISHED CVSS 4.300000190734863 MEDIUM

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.

EPSS 0.85% · 56.5th percentile

Risk Scores

CVSS 3.1
4.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS Score
0.85%
56.5th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:24.04:LTSlibspring-java4.3.30-2, 0, *
Ubuntu:Pro:16.04:LTSlibspring-java3.2.13-5, 0, 3.2.13-3
Ubuntu:Pro:22.04:LTSlibspring-java4.3.30-1, *, 0
Ubuntu:25.10libspring-java0, 4.3.30-3ubuntu1, 4.3.30-2ubuntu1
Ubuntu:Pro:20.04:LTSlibspring-java4.3.22-4ubuntu0.1~esm1, 4.3.22-4, 0
Ubuntu:Pro:18.04:LTSlibspring-java4.3.11-1, 4.3.12-1, 4.3.13-2
Ubuntu:Pro:14.04:LTSlibspring-java3.0.6.RELEASE-11, 3.0.6.RELEASE-13, 3.0.6.RELEASE-13ubuntu0.1~esm2

Timeline

  • Jan 5, 2022 CVE Published
  • Jan 8, 2022 EPSS Score
  • Mar 3, 2022 EPSS Score
  • Apr 26, 2022 EPSS Score
  • Jun 19, 2022 EPSS Score
  • Aug 13, 2022 EPSS Score
  • Oct 7, 2022 EPSS Score
  • Nov 30, 2022 EPSS Score
  • Jan 23, 2023 EPSS Score
  • Mar 18, 2023 EPSS Score
  • May 11, 2023 EPSS Score
  • Jul 4, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›