CVE-2022-22970
Published on: Not Yet Published
Last Modified on: 10/07/2022 01:17:00 PM UTC
Certain versions of Active Iq Unified Manager from Netapp contain the following vulnerability:
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
- CVE-2022-22970 has been assigned by
[email protected] to track the vulnerability - currently rated as MEDIUM severity.
CVSS3 Score: 5.3 - MEDIUM
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | HIGH | LOW | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | NONE | NONE | HIGH |
CVSS2 Score: 3.5 - LOW
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | MEDIUM | SINGLE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| NONE | NONE | PARTIAL |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| CVE-2022-22970 Spring Framework Vulnerability in NetApp Products | NetApp Product Security | security.netapp.com text/html |
CONFIRM security.netapp.com/advisory/ntap-20220616-0006/ |
| CVE-2022-22970 | Security | VMware Tanzu | tanzu.vmware.com text/html |
MISC tanzu.vmware.com/security/cve-2022-22970 |
| Oracle Critical Patch Update Advisory - July 2022 | www.oracle.com text/html |
MISC www.oracle.com/security-alerts/cpujul2022.html |
Related QID Numbers
- 376642 Spring Framework Denial of Service (DoS) Data Binding Vulnerability
Exploit/POC from Github
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file u…
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
| Application | Netapp | Brocade San Navigator | - | All | All | All |
| Application | Netapp | Cloud Secure Agent | - | All | All | All |
| Application | Netapp | Oncommand Insight | - | All | All | All |
| Application | Oracle | Financial Services Crime And Compliance Management Studio | 8.0.8.2.0 | All | All | All |
| Application | Oracle | Financial Services Crime And Compliance Management Studio | 8.0.8.3.0 | All | All | All |
| Application | Vmware | Spring Framework | All | All | All | All |
| Application | Vmware | Spring Framework | All | All | All | All |
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*:
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*:
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*:
- cpe:2.3:a:netapp:brocade_san_navigator:-:*:*:*:*:*:*:*:
- cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*:
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*:
- cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @CVEreport |
CVE-2022-22970 : In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications… twitter.com/i/web/status/1… | 2022-05-12 20:11:07 |
| @LinInfoSec |
Spring - CVE-2022-22970: tanzu.vmware.com/security/cve-2… | 2022-05-12 23:04:25 |
 /r/netcve |
CVE-2022-22970 | 2022-05-12 20:57:03 |