CVE-2022-22968: Input Validation
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-22968?
CVE-2022-22968 is a vulnerability in the Spring Framework that allows insufficient protection of fields due to case sensitivity in data binding rules.
What is the severity of CVE-2022-22968?
CVE-2022-22968 has a severity rating of medium.
Which versions of Spring Framework are affected by CVE-2022-22968?
Spring Framework versions 5.3.0 - 5.3.18 and 5.2.0 - 5.2.20, as well as older unsupported versions, are affected by CVE-2022-22968.
How can I fix CVE-2022-22968?
To fix CVE-2022-22968, update your Spring Framework to version 5.3.19 or 5.2.21, depending on the version you are using.
Where can I find more information about CVE-2022-22968?
You can find more information about CVE-2022-22968 on the Red Hat website at the following links: [link1](https://access.redhat.com/errata/RHSA-2022:5101), [link2](https://access.redhat.com/security/cve/cve-2022-22968), [link3](https://access.redhat.com/errata/RHSA-2022:5532).