Description
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- NetApp / active_iq_unified_manager
- NetApp / active_iq_unified_manager
- NetApp / active_iq_unified_manager
- NetApp / brocade_san_navigator
- NetApp / cloud_secure_agent
- NetApp / OnCommand Insight
- oracle / financial_services_crime_and_compliance_management_studio8.0.8.3.0 – 8.0.8.3.0
- oracle / financial_services_crime_and_compliance_management_studio8.0.8.2.0 – 8.0.8.2.0
- VMware / Spring Framework5.2.21
References
Updated 21m ago · 8 sources