Homepage

org.springframework:spring-beans@5.1.18.RELEASE vulnerabilities

  • latest version

    6.2.0

  • latest non vulnerable version

    6.2.0

  • first published

    19 years ago

  • latest version published

    27 days ago

  • licenses detected

  • package manager

    View on Maven Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.springframework:spring-beans package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Denial of Service (DoS)

    org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.

    Affected versions of this package are vulnerable to Denial of Service (DoS) if it relies on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

    How to fix Denial of Service (DoS)?

    Upgrade org.springframework:spring-beans to version 5.2.22.RELEASE, 5.3.20 or higher.

    [,5.2.22.RELEASE)[5.3.0,5.3.20)
    • C
    Remote Code Execution

    org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.

    Affected versions of this package are vulnerable to Remote Code Execution via manipulation of ClassLoader that is achievable with a POST HTTP request. This could allow an attacker to execute a webshell on a victim's application (TomCat), or download arbitrary files from the server (Payara/Glassfish).

    Note:

    • Current public exploits require victim applications to be built with JRE version 9 (or above) and to be deployed on either Tomcat, Payara, or Glassfish.

    • However, we have confirmed that it is technically possible for additional exploits to work under additional application configurations as well.

    • As such, while we recommend users prioritize first remediating against the configuration described above, for full protection, we also recommend upgrading all vulnerable versions to the fixed spring-beans version regardless of the application configuration.

    Update Log

    • 31/03/2022 - Severity was raised from 8.1 to 9.8
    • 08/04/2022 - Advisory was updated to reflect that Snyk's security research team was able to author a working PoC of this vulnerability against applications that are deployed on Payara (which is based on Glassfish).

    How to fix Remote Code Execution?

    Upgrade org.springframework:spring-beans to version 5.2.20, 5.3.18 or higher.

    [,5.2.20)[5.3.0,5.3.18)
    Go back to all versions of this package