WaratekVRT Sign in

CVE-2021-22096 Spring Framework

Affected softwareSpring Framework
Severity4.3 Medium CVSS 3.1 2 scores
Fixed in5.3.11, 5.2.18
WeaknessCWE-117
Published28 Oct 2021
Updated17 Jun 2026

Description

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 5 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 1.4% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

VRT has not found a public code change for this CVE yet.

  • Protection none
  • Action not pursued
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to No source fix or exploit.

CVSS

4.3 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N NVD Primary published
CVSS 2.0 4.0 none AV:N/AC:L/Au:S/C:N/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2022 ↗ CPU 2022-Q2 Oracle Communications / CNC Console (Spring boot) (1.9.0)
Oracle Communications / SCP (Spring Framework) (1.15.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications CNC Console (Spring boot) 1.9.0 1.9.0
Oracle Communications SCP (Spring Framework) 1.15.0 1.15.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.springframework:spring-core 5.3.0 5.3.11 unbounded
org.springframework:spring-core 5.2.0 5.2.18 unbounded
org.springframework:spring 5.2.0 5.2.18 unbounded
org.springframework:spring 5.3.0 5.3.11 unbounded

Products and versions

10 products, 13 version entries
SourceVendorProductSchemeAffected versions
nvd netapp active iq unified manager generic any version
nvd netapp management services for element software and netapp hci generic any version
nvd netapp metrocluster tiebreaker generic any version
nvd netapp snap creator framework generic any version
nvd netapp snapcenter generic any version
nvd oracle communications cloud native core console generic 1.9.0
nvd oracle communications cloud native core service communication proxy generic 1.15.0
osv org.springframework spring generic ≥ 5.2.0 and ＜ 5.2.18 · ≥ 5.3.0 and ＜ 5.3.11
osv org.springframework spring-core generic ≥ 5.2.0 and ＜ 5.2.18 · ≥ 5.3.0 and ＜ 5.3.11
nvd vmware spring framework generic ≥ 5.2.0 and ≤ 5.2.17 · ≥ 5.3.0 and ≤ 5.3.10

References

URLTags
https://github.com/spring-projects/spring-framework PACKAGE
https://security.netapp.com/advisory/ntap-20211125-0005 WEB
https://tanzu.vmware.com/security/cve-2021-22096 WEB
https://www.oracle.com/security-alerts/cpuapr2022.html WEB
https://security.netapp.com/advisory/ntap-20211125-0005/ Third Party Advisory

Timeline
Published2021-10-28By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.