org.springframework:spring-core@3.0.0.RELEASE vulnerabilities

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to String.toLowerCase() having some Locale dependent exceptions that could potentially result in fields not protected as expected.

Note: The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive.

Upgrade org.springframework:spring-core to version 6.1.14 or higher.

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Improper Input Validation when a user provides malicious input, causing insertion of additional log entries.

Upgrade org.springframework:spring-core to version 5.2.19.RELEASE, 5.3.14 or higher.

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Improper Output Neutralization for Logs when a user provides malicious input, causing insertion of additional log entries.

Upgrade org.springframework:spring-core to version 5.3.12, 5.2.18 or higher.

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Access Restriction Bypass. Remote attackers can bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.

Upgrade org.springframework:spring-core to version 3.0.6.RELEASE or higher.

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Directory Traversal. It allows remote attackers to read arbitrary files via a crafted URL.

Upgrade org.springframework:spring-core to version 3.2.9.RELEASE, 4.0.5.RELEASE or higher.

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Expression Language Injection. When a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."

Upgrade org.springframework:spring-core to version 2.5.6.SEC03, 3.0.6 or higher.

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Arbitrary Code Execution, via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

Upgrade org.springframework:spring-core to version 2.5.6.SEC01, 3.0.2.RELEASE or higher.