CVE-2021-22118 Spring Framework
| Affected software | Spring Framework |
|---|---|
| Severity | 7.8 High CVSS 3.1 2 scores |
| Fixed in | 5.2.15, 5.3.7 |
| Weakness | Improper privilege management (CWE-269) |
| Published | 27 May 2021 |
| Updated | 17 Jun 2026 |
Description
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
CWE-668
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 5 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 0.38% chance in 30 days
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available security rule
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Protected by Waratek. |
How to mitigate CVE-2021-22118
Upgrade Spring Framework to a release that fixes it: 5.2.15 or 5.3.7. Until you can, Waratek RASP blocks exploitation with a security rule that blocks this kind of attack. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
7.8 HIGH
v3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
7.8 HIGH v3.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 2.0 | 4.6 | none | AV:L/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2022 ↗ | CPU | 2022-Q3 | Oracle Retail Applications / Other (Spring Framework) (16.0.2) Oracle Supply Chain / Installation Issues (Spring Framework) (3.6.1) |
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle Commerce / Content Acquisition System (Spring Framework) (11.3.2) Oracle Communications / Visualization, Mediation (Spring Framework) (8.0.0-8.1.0, 8.2.0-8.2.3) Oracle Communications Applications / MSS Cartridge (Spring Framework) (7.3.6) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Communications / Binding Support Function (Spring Framework) (1.9.0) Oracle Communications / Policy (Spring Framework) (1.14.0) Oracle Communications / SCP (Spring Framework) (1.14.0) Oracle Communications / SEPP (Spring Framework) (1.6.0) Oracle Communications / UDR (Spring Framework) (1.14.0) Oracle Communications Applications / TMF API (Spring Framework) (7.4.1, 7.4.2, 7.5.0) Oracle Financial Services Applications / Others (Spring Framework) (8.0.8-8.1.1) Oracle Insurance Applications / Architecture (Spring Framework) (11.0.2, 11.1.0, 11.2.7, 11.3.0, 11.3.1) Oracle Retail Applications / Deal (Spring Framework) (16.0-19.0) Oracle Utilities Applications / Tools (Spring Framework) (6.0.0.1.1, 6.0.0.2.2, 6.0.0.3.1) |
| Oracle Critical Patch Update October 2021 ↗ | CPU | 2021-Q4 | Oracle Communications / Monitor (Spring Framework) (6.4) Oracle Communications / Reports (Spring Framework) (8.0.0.0-8.2.4.0) Oracle Communications / Route Manager (Spring Framework) (8.0.0.0-8.2.4.0) Oracle Communications / Work Orders (Spring Framework) (8.2.0.0-8.2.4.0) Oracle Communications Applications / Controller (Spring Framework) (12.0.0.3) Oracle Health Sciences Applications / Service Framework (Spring Framework) (8.1.0) Oracle Insurance Applications / Architecture (Spring Framework) (11.0.0 - 11.3.1) Oracle Insurance Applications / Development tools (Spring Framework) (12.6.0 - 12.6.4) Oracle MySQL / Monitoring: General (Spring Framework) (8.0.25 and prior) Oracle Retail Applications / Foundation (Spring Framework) (19.0.1) Oracle Retail Applications / Plan (Spring Framework) (16.0) Oracle Retail Applications / RPAS Fusion Client (Spring Framework) (14.1.3, 15.0.3, 16.0.3) |
| Oracle Critical Patch Update July 2021 ↗ | CPU | 2021-Q3 | Oracle Retail Applications / PeopleSoft Integration Bugs (Spring Framework) (16.0.3.0, 15.0.3.1, 14.1.3.2) Oracle Retail Applications / RIB Kernal (Spring Framework) (16.0.3.0, 15.0.3.1, 14.1.3.2) Oracle Retail Applications / System Administration (Spring Framework) (16.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Commerce | Content Acquisition System (Spring Framework) | 11.3.2 | 11.3.2 |
| Oracle Communications | Binding Support Function (Spring Framework) | 1.9.0 | 1.9.0 |
| Oracle Communications | Monitor (Spring Framework) | 6.4 | 6.4 |
| Oracle Communications | Policy (Spring Framework) | 1.14.0 | 1.14.0 |
| Oracle Communications | Reports (Spring Framework) | 8.0.0.0-8.2.4.0 | |
| Oracle Communications | Route Manager (Spring Framework) | 8.0.0.0-8.2.4.0 | |
| Oracle Communications | SCP (Spring Framework) | 1.14.0 | 1.14.0 |
| Oracle Communications | SEPP (Spring Framework) | 1.6.0 | 1.6.0 |
| Oracle Communications | UDR (Spring Framework) | 1.14.0 | 1.14.0 |
| Oracle Communications | Visualization, Mediation (Spring Framework) | 8.0.0-8.1.0, 8.2.0-8.2.3 | |
| Oracle Communications | Work Orders (Spring Framework) | 8.2.0.0-8.2.4.0 | |
| Oracle Communications Applications | Controller (Spring Framework) | 12.0.0.3 | 12.0.0.3 |
| Oracle Communications Applications | MSS Cartridge (Spring Framework) | 7.3.6 | 7.3.6 |
| Oracle Communications Applications | TMF API (Spring Framework) | 7.4.1, 7.4.2, 7.5.0 | 7.4.1 · 7.4.2 · 7.5.0 |
| Oracle Financial Services Applications | Others (Spring Framework) | 8.0.8-8.1.1 | |
| Oracle Health Sciences Applications | Service Framework (Spring Framework) | 8.1.0 | 8.1.0 |
| Oracle Insurance Applications | Architecture (Spring Framework) | 11.0.0 - 11.3.1 | 11.0.2 · 11.1.0 · 11.2.7 · 11.3.0 · 11.3.1 |
| Oracle Insurance Applications | Development tools (Spring Framework) | 12.6.0 - 12.6.4 | |
| Oracle MySQL | Monitoring: General (Spring Framework) | 8.0.25 and prior | |
| Oracle Retail Applications | Deal (Spring Framework) | 16.0-19.0 | |
| Oracle Retail Applications | Foundation (Spring Framework) | 19.0.1 | 19.0.1 |
| Oracle Retail Applications | Other (Spring Framework) | 16.0.2 | 16.0.2 |
| Oracle Retail Applications | PeopleSoft Integration Bugs (Spring Framework) | 16.0.3.0, 15.0.3.1, 14.1.3.2 | 14.1.3.2 · 15.0.3.1 · 16.0.3.0 |
| Oracle Retail Applications | Plan (Spring Framework) | 16.0 | 16.0 |
| Oracle Retail Applications | RIB Kernal (Spring Framework) | 16.0.3.0, 15.0.3.1, 14.1.3.2 | 14.1.3.2 · 15.0.3.1 · 16.0.3.0 |
| Oracle Retail Applications | RPAS Fusion Client (Spring Framework) | 14.1.3, 15.0.3, 16.0.3 | 14.1.3 · 15.0.3 · 16.0.3 |
| Oracle Retail Applications | System Administration (Spring Framework) | 16.0 | 16.0 |
| Oracle Supply Chain | Installation Issues (Spring Framework) | 3.6.1 | 3.6.1 |
| Oracle Utilities Applications | Tools (Spring Framework) | 6.0.0.1.1, 6.0.0.2.2, 6.0.0.3.1 | 6.0.0.1.1 · 6.0.0.2.2 · 6.0.0.3.1 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.springframework:spring-web |
5.2.0 | 5.2.15 |
unbounded |
org.springframework:spring-web |
5.3.0 | 5.3.7 |
unbounded |
Products and versions
33 products, 51 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | netapp | hci | generic | any version |
| nvd | netapp | management services for element software | generic | any version |
| nvd | oracle | commerce guided search | generic | 11.3.2 |
| nvd | oracle | communications brm - elastic charging engine | generic | 12.0.0.3 |
| nvd | oracle | communications cloud native core binding support function | generic | 1.9.0 |
| nvd | oracle | communications cloud native core policy | generic | 1.14.0 |
| nvd | oracle | communications cloud native core security edge protection proxy | generic | 1.6.0 |
| nvd | oracle | communications cloud native core service communication proxy | generic | 1.14.0 |
| nvd | oracle | communications cloud native core unified data repository | generic | 1.14.0 |
| nvd | oracle | communications diameter intelligence hub | generic | ≥ 8.0.0 and ≤ 8.1.0 · ≥ 8.2.0 and ≤ 8.2.3 |
| nvd | oracle | communications element manager | generic | ≥ 8.2.0 and ≤ 8.2.4.0 |
| nvd | oracle | communications interactive session recorder | generic | 6.4 |
| nvd | oracle | communications network integrity | generic | 7.3.6 |
| nvd | oracle | communications session report manager | generic | ≥ 8.0.0 and ≤ 8.2.4.0 |
| nvd | oracle | communications session route manager | generic | ≥ 8.0.0 and ≤ 8.2.4.0 |
| nvd | oracle | communications unified inventory management | generic | 7.4.1 · 7.4.2 · 7.5.0 |
| nvd | oracle | documaker | generic | ≥ 12.6.0 and ≤ 12.6.4 |
| nvd | oracle | enterprise data quality | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | financial services analytical applications infrastructure | generic | ≥ 8.0.8 and ≤ 8.1.1 |
| nvd | oracle | healthcare data repository | generic | 8.1.0 |
| nvd | oracle | insurance policy administration | generic | ≥ 11.0 and ≤ 11.3.1 |
| nvd | oracle | insurance rules palette | generic | 11.0.2 · 11.1.0 · 11.2.7 · 11.3.0 · 11.3.1 |
| nvd | oracle | mysql enterprise monitor | generic | ≤ 8.0.25 |
| nvd | oracle | retail assortment planning | generic | 16.0 |
| nvd | oracle | retail customer management and segmentation foundation | generic | ≥ 16.0 and ≤ 19.0 |
| nvd | oracle | retail financial integration | generic | 14.1.3.2 · 15.0.3.1 · 16.0.3 |
| nvd | oracle | retail integration bus | generic | 14.1.3.2 · 15.0.3.1 · 16.0.3 |
| nvd | oracle | retail merchandising system | generic | 19.0.1 |
| nvd | oracle | retail order broker | generic | 16.0 |
| nvd | oracle | retail predictive application server | generic | 14.1.3 · 15.0.3 · 16.0.3 |
| nvd | oracle | utilities testing accelerator | generic | 6.0.0.1.1 · 6.0.0.2.2 · 6.0.0.3.1 |
| osv | org.springframework | spring-web | generic | ≥ 5.2.0 and ＜ 5.2.15 · ≥ 5.3.0 and ＜ 5.3.7 |
| nvd | vmware | spring framework | generic | ≥ 5.2.0 and ＜ 5.2.15 · ≥ 5.3.0 and ＜ 5.3.7 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** REPORTS (SPRING FRAMEWORK), PLAN (SPRING FRAMEWORK), TOOLS (SPRING FRAMEWORK), MONITOR (SPRING FRAMEWORK), DEAL (SPRING FRAMEWORK), TMF API (SPRING FRAMEWORK), SERVICE FRAMEWORK (SPRING FRAMEWORK), ROUTE MANAGER (SPRING FRAMEWORK), UDR (SPRING FRAMEWORK), OTHERS (SPRING FRAMEWORK), FOUNDATION (SPRING FRAMEWORK), SCP (SPRING FRAMEWORK), MONITORING: GENERAL (SPRING FRAMEWORK), SEPP (SPRING FRAMEWORK), SYSTEM ADMINISTRATION (SPRING FRAMEWORK), CONTROLLER (SPRING FRAMEWORK), POLICY (SPRING FRAMEWORK), BINDING SUPPORT FUNCTION (SPRING FRAMEWORK), DEVELOPMENT TOOLS (SPRING FRAMEWORK), RPAS FUSION CLIENT (SPRING FRAMEWORK), RIB KERNAL (SPRING FRAMEWORK), PEOPLESOFT INTEGRATION BUGS (SPRING FRAMEWORK), WORK ORDERS (SPRING FRAMEWORK), ARCHITECTURE (SPRING FRAMEWORK) **Products:** ORACLE COMMUNICATIONS SESSION ROUTE MANAGER, ORACLE HEALTHCARE DATA REPOSITORY, ORACLE RETAIL ASSORTMENT PLANNING, ORACLE COMMUNICATIONS CLOUD NATIVE CORE SECURITY EDGE PROTECTION PROXY, ORACLE RETAIL PREDICTIVE APPLICATION SERVER, ORACLE COMMUNICATIONS CLOUD NATIVE CORE SERVICE COMMUNICATION PROXY, ORACLE RETAIL FINANCIAL INTEGRATION, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE RETAIL MERCHANDISING SYSTEM, ORACLE MYSQL, ORACLE RETAIL APPLICATIONS, ORACLE FINANCIAL SERVICES ANALYTICAL APPLICATIONS INFRASTRUCTURE, ORACLE UTILITIES TESTING ACCELERATOR, ORACLE COMMUNICATIONS SESSION REPORT MANAGER, ORACLE INSURANCE APPLICATIONS, ORACLE RETAIL CUSTOMER MANAGEMENT AND SEGMENTATION FOUNDATION, ORACLE COMMUNICATIONS INTERACTIVE SESSION RECORDER, ORACLE COMMUNICATIONS BRM - ELASTIC CHARGING ENGINE, MYSQL ENTERPRISE MONITOR, ORACLE COMMUNICATIONS ELEMENT MANAGER, ORACLE INSURANCE POLICY ADMINISTRATION, ORACLE RETAIL INTEGRATION BUS, ORACLE COMMUNICATIONS, ORACLE DOCUMAKER, ORACLE COMMUNICATIONS UNIFIED INVENTORY MANAGEMENT, ORACLE COMMUNICATIONS CLOUD NATIVE CORE UNIFIED DATA REPOSITORY, ORACLE COMMUNICATIONS CLOUD NATIVE CORE BINDING SUPPORT FUNCTION, ORACLE RETAIL ORDER BROKER, ORACLE INSURANCE RULES PALETTE, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE UTILITIES APPLICATIONS, ORACLE HEALTH SCIENCES APPLICATIONS, ORACLE COMMUNICATIONS CLOUD NATIVE CORE POLICY
References
Timeline
Timeline
| Published | 2021-05-27 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |