{"id":"CVE-2024-22243","published":"2024-02-23T05:03:54Z","modified":"2025-02-13T17:33:38Z","title":"CVE-2024-22243: Spring Framework URL Parsing with Host Validation","vendor":"Spring","product":"Spring Framework","tier":"tail","description":{"text":"Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03967,"percentile":0.90444,"provenance":"source"},"cwes":[{"id":"CWE-601","name":"URL Redirection to Untrusted Site"}],"references":[{"url":"https://spring.io/security/cve-2024-22243","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20240524-0001/","tags":[]},{"url":"http://seclists.org/fulldisclosure/2024/Sep/24","tags":[]}],"priority":{"score":28.8,"factors":[{"name":"EPSS percentile","points":18.09},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":5.67}]},"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2024-02-21","earliestUrl":"https://github.com/SeanPesce/CVE-2024-22243","repos":[{"name":"SeanPesce/CVE-2024-22243","url":"https://github.com/SeanPesce/CVE-2024-22243","stars":13,"created":"2024-02-21"},{"name":"shellfeel/CVE-2024-22243-CVE-2024-22234","url":"https://github.com/shellfeel/CVE-2024-22243-CVE-2024-22234","stars":5,"created":"2024-02-23"},{"name":"Reivap/CVE-2024-22243","url":"https://github.com/Reivap/CVE-2024-22243","stars":0,"created":"2025-02-21"}]},"first":{"date":"2024-02-21","source":"PoC-in-GitHub","url":"https://github.com/SeanPesce/CVE-2024-22243"},"provenance":"source"},"vendorSlug":"spring","affectedVersions":[{"vendor":"Spring","product":"Spring Framework","versions":[">= 6.0.x, < 6.0.17",">= 6.1.x, < 6.1.4",">= 5.3.x, < 5.3.32"]}],"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-web","vulnerableRanges":[">=6.1.0, <6.1.4",">=6.0.0, <6.0.17",">=5.3.0, <5.3.32","<=5.2.25.RELEASE"],"patched":["6.1.4","6.0.17","5.3.32"],"from":["GHSA-ccgv-vj62-xf9h"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0615","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-spring-framework-cve-2015-5211","packageHistory":[{"cve":"CVE-2018-11039","published":"2018-06-25","fixed":"5.0.7","kev":false},{"cve":"CVE-2021-22118","published":"2021-05-27","fixed":"5.3.7","kev":false},{"cve":"CVE-2016-1000027","published":"2020-01-02","fixed":"6.0.0","kev":false},{"cve":"CVE-2024-22243","published":"2024-02-23","fixed":"6.1.4","kev":false},{"cve":"CVE-2024-22259","published":"2024-03-16","fixed":"6.1.5","kev":false,"link":{"from":"CVE-2024-22243","to":"CVE-2024-22259","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-web","fromFixed":"5.3.32","toFixed":"5.3.33","daysApart":22},{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-web","fromFixed":"6.1.4","toFixed":"6.1.5","daysApart":22},{"kind":"similar","provenance":"machine","score":0.96,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2024-22262","published":"2024-04-16","fixed":"6.1.6","kev":false},{"cve":"CVE-2024-38809","published":"2024-09-27","fixed":"6.1.12","kev":false}],"package":"Maven:org.springframework:spring-web"}}