CVE-2024-22243 — CVE-2024-22243: Spring Framework URL Parsing with Host Validation

Description (CNA)

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.

Affected (CNA)

Vendor / product	Versions
Spring / Spring Framework	affected 6.0.x before 6.0.17; affected 6.1.x before 6.1.4; affected 5.3.x before 5.3.32

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2024-22243
https://security.netapp.com/advisory/ntap-20240524-0001/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://spring.io/security/cve-2024-22243
https://security.netapp.com/advisory/ntap-20240524-0001/
http://seclists.org/fulldisclosure/2024/Sep/24