CVE-2022-27772: High severity vmware spring boot tools vulnerability
UNSUPPORTED WHEN ASSIGNED spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that are no longer supported by the maintainer.
Other sources
Spring Boot could allow a local authenticated attacker to gain elevated privileges on the system, caused by temporary directory hijacking in org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. By placing a specially-crafted file, an attacker could exploit this vulnerability to take over the application.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-27772?
CVE-2022-27772 is a vulnerability in spring-boot versions prior to version 2.2.11.RELEASE that allows temporary directory hijacking.
How does CVE-2022-27772 impact spring-boot?
CVE-2022-27772 impacts the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method.
Which versions of spring-boot are affected by CVE-2022-27772?
Versions prior to v2.2.11.RELEASE of spring-boot are affected by CVE-2022-27772.
What is the severity of CVE-2022-27772?
CVE-2022-27772 has a severity rating of 7.8 (high).
How can I fix CVE-2022-27772?
To fix CVE-2022-27772, update your spring-boot version to v2.2.11.RELEASE or later.