-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from improper PropertyDescriptor filtering in Spring's data binding mechanism. The commit 002546b shows the original code allowed binding to Class.class properties except 'classLoader'/'protectionDomain' by name, but didn't check property types. Attackers could exploit this by accessing ClassLoader/ProtectionDomain properties through alternative property paths or interface inheritance. The vulnerable functions are directly responsible for processing property descriptors during object binding, making them the root cause of the RCE vulnerability when combined with JDK 9+ and Tomcat WAR deployment.
CachedIntrospectionResults.CachedIntrospectionResults(Class<?>)spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java
CachedIntrospectionResults.introspectInterfacesspring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.springframework:spring-beans | maven | >= 5.3.0, < 5.3.18 | 5.3.18 |
| org.springframework:spring-webmvc | maven | >= 5.3.0, < 5.3.18 | 5.3.18 |
| org.springframework.boot:spring-boot-starter-web | maven | < 2.5.12 | 2.5.12 |
| org.springframework.boot:spring-boot-starter-web | maven | >= 2.6.0, < 2.6.6 | 2.6.6 |
| org.springframework:spring-webflux | maven | >= 5.3.0, < 5.3.18 | 5.3.18 |
| org.springframework.boot:spring-boot-starter-webflux | maven | < 2.5.12 | 2.5.12 |
| org.springframework.boot:spring-boot-starter-webflux | maven | >= 2.6.0, < 2.6.6 | 2.6.6 |
| org.springframework:spring-beans | maven | < 5.2.20.RELEASE | 5.2.20.RELEASE |
| org.springframework:spring-webmvc | maven | < 5.2.20.RELEASE | 5.2.20.RELEASE |
| org.springframework:spring-webflux | maven | < 5.2.20.RELEASE | 5.2.20.RELEASE |