VDB
DEBIAN-CVE-2022-22968
DEBIAN-CVE-2022-22968
PUBLISHED
CVSS 5.300000190734863 MEDIUM
Record from OSV · Published April 14, 2022
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
Risk scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | libspring-java | 0, 4.3.30-3, 4.3.30-4 |
| Debian:12 | libspring-java | 0, 4.3.30-2, 4.3.30-3 |
| Debian:13 | libspring-java | 0, 4.3.30-3, 4.3.30-4 |
Timeline
- Apr 14, 2022 CVE Published
- Oct 9, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2022-22968
vulnetix vdb fixes DEBIAN-CVE-2022-22968Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2022-22968/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart