Read the docs
TI-2022-21274 Aliases CVE-2022-43484GHSA-q5j9-f95w-f4pr

Improper input validation in NTT DATA Corporation TERASOLUNA Global Framework and…

Priority HIGH 69CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1 are vulnerable to a ClassLoader manipulation vulnerability due to using the old version of Spring Framework which contains the vulnerability.The vulnerability is caused by an improper input validation issue in the binding mechanism of Spring MVC. By the application processing a specially crafted file, arbitrary code may be executed with the privileges of the application.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00419 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.terasoluna.gfw:terasoluna-gfw-common (Maven): 1.0.1.RELEASE

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NTT DATA CorporationTERASOLUNA Global Framework and TERASOLUNA Server Framework for Java (Rich)TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1—No fix listedCNA
—org.terasoluna.gfw:terasoluna-gfw-common (Maven)before 1.0.1.RELEASE1.0.1.RELEASEPatch availableGHSA-q5j9-f95w-f4pr
  • TERASOLUNA Global Framework and TERASOLUNA Server Framework for Java (Rich) VendorNTT DATA Corporation Affected TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1 Fixed in — No fix listed CNA
  • org.terasoluna.gfw:terasoluna-gfw-common (Maven) Vendor— Affected before 1.0.1.RELEASE Fixed in 1.0.1.RELEASE Patch available GHSA-q5j9-f95w-f4pr

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:nttdata:terasoluna_global_framework:1.0.0:*:*:*:public_review:*:*:*1.0.0VulnerableNTT DATA Corporation
cpe:2.3:a:nttdata:terasoluna_server_framework_for_java_\(rich\):*:*:*:*:*:*:*:*2.0.0.2 – 2.0.5.1VulnerableNTT DATA Corporation
  • cpe:2.3:a:nttdata:terasoluna_global_framework:1.0.0:*:*:*:public_review:*:*:* Versions 1.0.0 Vulnerable ·NTT DATA Corporation
  • cpe:2.3:a:nttdata:terasoluna_server_framework_for_java_\(rich\):*:*:*:*:*:*:*:* Versions 2.0.0.2 – 2.0.5.1 Vulnerable ·NTT DATA Corporation

Remediation

  • Fix · GHSA-q5j9-f95w-f4pr org.terasoluna.gfw:terasoluna-gfw-common (Maven) Fixed in 1.0.1.RELEASE Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43484
  2. 2026-10-03 Alias added: GHSA-q5j9-f95w-f4pr

References

Exploit 1

Advisory 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences