CVE-2021-22096

CVE Database · CVE-2021-22096

CVE-2021-22096

· MEDIUMModified

CVSS v3.1

4.3

EPSS

1.27%

Published

Oct 28, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-117

Affected Products (11)

vmware · spring_frameworkvulnerable

netapp · active_iq_unified_managervulnerable

netapp · management_services_for_element_software_and_netapp_hcivulnerable

netapp · metrocluster_tiebreakervulnerable

netapp · snap_creator_frameworkvulnerable

netapp · snapcentervulnerable

oracle · communications_cloud_native_core_console

References (6)

https://security.netapp.com/advisory/ntap-20211125-0005/

Third Party Advisory

https://tanzu.vmware.com/security/cve-2021-22096

Vendor Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Third Party Advisory

https://security.netapp.com/advisory/ntap-20211125-0005/

Third Party Advisory

https://tanzu.vmware.com/security/cve-2021-22096

Vendor Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs