CVE-2021-22096

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

References

Affected packages

Git / github.com/spring-projects/spring-framework

Affected ranges

Type

GIT

Repo

https://github.com/spring-projects/spring-framework

Events

Introduced

927b8c15ef20eaaa4002d4b2170cc536a6d6aa35

Last affected

e45e77fd47e38d008fff7151f47a49f0c4a38d3b

Introduced

5acffaa72da10ba42fe547eeea44d8615cbf99b9

Last affected

21c3b51e1fcf0a20f9880d280a71cbace4905e41

Database specific

{
    "versions": [
        {
            "introduced": "5.2.0"
        },
        {
            "last_affected": "5.2.17"
        },
        {
            "introduced": "5.3.0"
        },
        {
            "last_affected": "5.3.10"
        }
    ]
}

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.15.0"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22096.json"