CVE-2022-22971: spring framework from 5.2.0 (inclusive), through 5.2.21 (inclusive), from 5.3.0 (inclusive), through 5.3.19…

Affected technology

spring framework · from 5.2.0 (inclusive), through 5.2.21 (inclusive)
vmware

spring framework · from 5.3.0 (inclusive), through 5.3.19 (inclusive)
vmware

financial services crime and compliance management studio · 8.0.8.2.0
oracle

financial services crime and compliance management studio · 8.0.8.3.0
oracle

cloud secure agent · Version not applicable in the source CPE
netapp

oncommand insight · Version not applicable in the source CPE
netapp

Spring Framework · Spring Framework versions 5.3.x prior to 5.3.20, 5.2.x prior to 5.2.22 and all old and unsupported versions
Vendor not specified by the source

Description’s affected range: versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

NVD’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.