← CVE Intelligence

CVE-2024-22236

Spring / Spring Cloud Contract PUBLISHED

Description (CNA)

In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in the org.springframework.cloud:spring-cloud-contract-shade dependency.

Affected (CNA)

Vendor / productVersions
Spring / Spring Cloud Contractaffected 4.1.0 before 4.1.1; affected 4.0.0 before 4.0.6; affected 3.1.0 before 3.1.10

CWE

No CWE identifiers supplied.

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.