In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported…
Priority LOW 39CWE-178Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 2 fixed, 11 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05666 93rd percentileScored 2026-11-07
Fix Partial org.springframework:spring-context (Maven): 5.3.19, 5.2.21.RELEASERed Hat: 2 advisoriesRed Hat: 2 fixed, 11 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Spring Framework | Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions | — | No fix listed | CNA |
| — | org.springframework:spring-context (Maven) | 5.3.0 to before 5.3.19 | 5.3.19 | Patch available | GHSA-g5mm-vmx4-3rg7 |
| — | org.springframework:spring-context (Maven) | before 5.2.21.RELEASE | 5.2.21.RELEASE | Patch available | GHSA-g5mm-vmx4-3rg7 |
- Spring Framework Vendor— Affected Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions Fixed in — No fix listed CNA
- org.springframework:spring-context (Maven) Vendor— Affected 5.3.0 to before 5.3.19 Fixed in 5.3.19 Patch available GHSA-g5mm-vmx4-3rg7
- org.springframework:spring-context (Maven) Vendor— Affected before 5.2.21.RELEASE Fixed in 5.2.21.RELEASE Patch available GHSA-g5mm-vmx4-3rg7
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* | before 5.2.0; 5.2.0 – 5.2.20; 5.3.0 – 5.3.18 | Vulnerable | VMware |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:metrocluster_tiebreaker:-:*:*:*:*:clustered_data_ontap:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* | up to 8.0.29 | Vulnerable | Oracle |
- cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions before 5.2.0; 5.2.0 – 5.2.20; 5.3.0 – 5.3.18 Vulnerable ·VMware
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:metrocluster_tiebreaker:-:*:*:*:*:clustered_data_ontap:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 8.0.29 Vulnerable ·Oracle
Remediation
- Fix · GHSA-g5mm-vmx4-3rg7 org.springframework:spring-context (Maven) Fixed in 5.3.19 Advisory →
- Fix · GHSA-g5mm-vmx4-3rg7 org.springframework:spring-context (Maven) Fixed in 5.2.21.RELEASE Advisory →
Red Hat 2 advisories
- RHSA-2022:5532 Released 2022-07-07 · Red Hat rating ImportantRed Hat Fuse 7.11.0 release and security update
- Red Hat Fuse 7.11
- RHSA-2022:5101 Released 2022-06-16 · Red Hat rating ImportantRed Hat AMQ Broker 7.10.0 release and security update
- Red Hat AMQ 7.10.0
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Red Hat Decision Manager 7 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel K 1 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Data Virtualisation Operator | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat AMQ 7.10.0 | Fixed | RHSA-2022:5101 |
| Red Hat Fuse 7.11 | Fixed | RHSA-2022:5532 |
Not affected: 9 products
- A-MQ Clients 2
- Red Hat Data Grid 8
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Application Runtimes
- Red Hat Single Sign-On 7
- Red Hat build of Quarkus
- Red Hat support for Spring Boot
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22968
- 2026-10-03 Alias added: GHSA-g5mm-vmx4-3rg7
- 2026-10-08 CISA SSVC decision points changed
References
Advisory 4
Other 4
- https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea
- https://github.com/spring-projects/spring-framework/commit/a7cf19cec5ebd270f97a194d749e2d5701ad2ab7
- https://github.com/spring-projects/spring-framework
- https://security.netapp.com/advisory/ntap-20220602-0004
Sources
- CVE-2022-22968 · CVE Program
- CVE-2022-22968 · NVD
- FIRST EPSS
- GHSA-g5mm-vmx4-3rg7 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-22968 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences