Patchfirst
Patchfirst
ChainSpring FrameworkMaven:org.springframework:spring-web

Spring Framework: fix bypasses (2015–2024)

11 CVEs over 4 generations, 25 May 2017 to 19 Dec 2024.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2015-521125 May 2017 First in the chain
  2. CVE-2018-1104025 Jun 2018 related to CVE-2015-5211
  3. CVE-2020-542119 Sep 2020 bypassed the fix for CVE-2015-5211
  4. CVE-2023-3405328 Nov 2023 No direct link to an earlier CVE
  5. CVE-2024-2224323 Feb 2024 No direct link to an earlier CVE
  6. CVE-2024-2225916 Mar 2024 next fix after CVE-2024-22243
  7. CVE-2024-2226216 Apr 2024 next fix after CVE-2024-22259
  8. CVE-2024-3881613 Sep 2024 No direct link to an earlier CVE
  9. CVE-2024-3880927 Sep 2024 next fix after CVE-2024-22262
  10. CVE-2024-3882018 Oct 2024 related to CVE-2024-38809related to CVE-2015-5211and 2 more
  11. CVE-2024-3881919 Dec 2024 related to CVE-2024-38816related to CVE-2024-38820
20172018201920202021202220232024 CVE-2015-5211 → CVE-2020-5421: bypassed the fix (high confidence)CVE-2024-38816 → CVE-2024-38819: related (high confidence)CVE-2024-38809 → CVE-2024-38820: related (high confidence)CVE-2015-5211 → CVE-2018-11040: related (medium confidence)CVE-2015-5211 → CVE-2024-38820: related (medium confidence)CVE-2023-34053 → CVE-2024-38820: related (medium confidence)CVE-2024-22243 → CVE-2024-22259: Next fix in the same package (medium confidence)CVE-2024-22259 → CVE-2024-22262: Next fix in the same package (medium confidence)CVE-2024-22259 → CVE-2024-38820: related (medium confidence)CVE-2024-38820 → CVE-2024-38819: related (medium confidence)CVE-2024-22262 → CVE-2024-38809: Next fix in the same package (low confidence) CVE-2015-5211 25 May 2017 CVE-2018-11040 25 Jun 2018 CVE-2020-5421 19 Sep 2020 CVE-2023-34053 28 Nov 2023 CVE-2024-22243 23 Feb 2024 CVE-2024-22259 16 Mar 2024 CVE-2024-22262 16 Apr 2024 CVE-2024-38816 13 Sep 2024 CVE-2024-38809 27 Sep 2024 CVE-2024-38820 18 Oct 2024 CVE-2024-38819 19 Dec 2024 20172018201920202021202220232024 CVE-2015-5211 → CVE-2020-5421: bypassed the fix (high confidence)CVE-2024-38816 → CVE-2024-38819: related (high confidence)CVE-2024-38809 → CVE-2024-38820: related (high confidence)CVE-2015-5211 → CVE-2018-11040: related (medium confidence)CVE-2015-5211 → CVE-2024-38820: related (medium confidence)CVE-2023-34053 → CVE-2024-38820: related (medium confidence)CVE-2024-22243 → CVE-2024-22259: Next fix in the same package (medium confidence)CVE-2024-22259 → CVE-2024-22262: Next fix in the same package (medium confidence)CVE-2024-22259 → CVE-2024-38820: related (medium confidence)CVE-2024-38820 → CVE-2024-38819: related (medium confidence)CVE-2024-22262 → CVE-2024-38809: Next fix in the same package (low confidence) CVE-2015-5211 25 May 2017 CVE-2018-11040 25 Jun 2018 CVE-2020-5421 19 Sep 2020 CVE-2023-34053 28 Nov 2023 CVE-2024-22243 23 Feb 2024 CVE-2024-22259 16 Mar 2024 CVE-2024-22262 16 Apr 2024 CVE-2024-38816 13 Sep 2024 CVE-2024-38809 27 Sep 2024 CVE-2024-38820 18 Oct 2024 CVE-2024-38819 19 Dec 2024
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2015-5211 25 May 2017 Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported… · fixed in 4.2.2 First in chain 17.0
CVE-2018-11040 25 Jun 2018 Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web… · fixed in 5.0.7.RELEASE CVE-2015-5211 · related · Medium 17.6
CVE-2020-5421 19 Sep 2020 RFD Protection Bypass via jsessionid CVE-2015-5211 · bypassed the fix · High 30.3
CVE-2023-34053 28 Nov 2023 Spring Framework server Web Observations DoS Vulnerability · fixed in 6.0.14 First in chain 17.1
CVE-2024-22243 23 Feb 2024 CVE-2024-22243: Spring Framework URL Parsing with Host Validation · fixed in 6.1.4 First in chain 28.8
CVE-2024-22259 16 Mar 2024 CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report) · fixed in 6.1.5 CVE-2024-22243 · Next fix in the same package · Medium 22.7
CVE-2024-22262 16 Apr 2024 CVE-2024-22262: Spring Framework URL Parsing with Host Validation · fixed in 6.1.6 CVE-2024-22259 · Next fix in the same package · Medium 19.3
CVE-2024-38816 13 Sep 2024 CVE-2024-38816: Path traversal vulnerability in functional web frameworks · fixed in 6.1.13 First in chain 65.5
CVE-2024-38809 27 Sep 2024 Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack · fixed in 6.1.12 CVE-2024-22262 · Next fix in the same package · Low 15.4
CVE-2024-38820 18 Oct 2024 CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception · fixed in 6.1.14 CVE-2024-38809 · related · High 12.1
CVE-2024-38819 19 Dec 2024 Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to… · fixed in 6.1.14 CVE-2024-38816 · related · High 31.8
↑ ↓ chooseEnter openEsc close