CVE-2024-22262
| Severity | 8.1 High CVSS 3.1 |
|---|---|
| Fixed in | 5.3.34, 6.0.19, 6.1.6 |
| Weakness | Server-side request forgery (CWE-918) |
| Published | 16 Apr 2024 |
| Updated | 13 Nov 2026 |
Description
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
CWE-601
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 2 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 1.2% chance in 30 days
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Open redirection
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Open Redirect Rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: Open Redirect Rule
How to mitigate CVE-2024-22262
Upgrade the affected software to a release that fixes it: 5.3.34, 6.0.19 or 6.1.6. Until you can, Waratek RASP blocks exploitation with its open redirection rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2024 ↗ | CPU | 2024-Q4 | Oracle Communications / BEServer (Spring Framework) (24.1.0.0.0) Oracle Communications / User Interface (Spring Framework) (9.1.1.8.0) Oracle Financial Services Applications / Authentication (Spring Framework) (22.1.0.0.0, 22.2.0.0.0) Oracle Fusion Middleware / Fusion Apps (Spring Framework) (14.1.1.0.0) Oracle Fusion Middleware / Third Party (Spring Framework) (12.2.1.4.0) Oracle Systems / Tools (Spring Framework) (4) |
| Oracle Critical Patch Update July 2024 ↗ | CPU | 2024-Q3 | Oracle Commerce / Content Acquisition System, Workbench (Spring Framework) (11.3.2) Oracle Commerce / Platform (Spring Framework) (11.3.0, 11.3.1, 11.3.2) Oracle Communications / Alarms, KPI, and Measurements (Spring Framework) (23.4.0-23.4.4) Oracle Communications / Automated Test Suite (Spring Framework) (24.2.0) Oracle Communications / Install (Spring Framework) (23.4.0-23.4.3) Oracle Communications / Install (Spring Framework) (23.4.2) Oracle Communications / Install (Spring Framework) (23.4.2) Oracle Communications / Security (Spring Framework) (46.6.4, 46.6.5) Oracle Communications / Signaling (Spring Framework) (23.4.0) Oracle Communications / Signaling (Spring Framework) (23.4.3) Oracle Communications Applications / Orchestration (Spring Framework) (12.0.0.4-12.0.0.8, 15.0.0.0) Oracle Construction and Engineering / Admin (Spring Framework) (19.12.0-19.12.19, 20.12.0-20.12.14, 21.12.0-21.12.12) Oracle Construction and Engineering / Document Management (Spring Framework) (22.12.0-22.12.13, 23.12.0-23.12.6) Oracle Financial Services Applications / Accessibility (Spring Framework) (14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Base (Spring Framework) (14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Basic Config/Maintenances (Spring Framework) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Common (Spring Framework) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Common (Spring Framework) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Common (Spring Framework) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Infrastructure (Spring Framework) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Infrastructure (Spring Framework) (8.0.7, 8.0.8, 8.1.1, 8.1.2) Oracle Financial Services Applications / Installer (Spring Framework) (8.0.8.2.8, 8.1.1.1.18, 8.1.2.6.4, 8.1.2.7.3) Oracle Financial Services Applications / Installer (Spring Framework) (8.1.2.5, 8.1.2.6) Oracle Financial Services Applications / Platform (Spring Framework) (8.0.8.0) Oracle Financial Services Applications / Platform (Spring Framework) (8.0.8.1, 8.1.1.1, 8.1.2.6, 8.1.2.7) Oracle Financial Services Applications / Reports (Spring Framework) (14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Reports (Spring Framework) (8.1.2.6, 8.1.2.7) Oracle Fusion Middleware / Core (Spring Framework) (12.2.1.4.0, 14.1.1.0.0) Oracle HealthCare Applications / Core (Spring Framework) (5.0.0-5.0.9) Oracle HealthCare Applications / FHIR Server (Spring Framework) (8.1.4, 8.2.0) Oracle Insurance Applications / Architecture (Spring Framework) (11.2.11, 11.3.0-11.3.2) Oracle Insurance Applications / Docupresentment IDS Server (Spring Framework) (12.6.4, 12.7.1) Oracle MySQL / Monitoring: General (Spring Framework) (8.0.38 and prior) Oracle Retail Applications / Application Core (Spring Framework) (15.0.3, 16.0.3) Oracle Retail Applications / PeopleSoft Integration Bugs (Spring Framework) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1) Oracle Retail Applications / RIB Kernal (Spring Framework) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Commerce | Content Acquisition System, Workbench (Spring Framework) | 11.3.2 | 11.3.2 |
| Oracle Commerce | Platform (Spring Framework) | 11.3.0, 11.3.1, 11.3.2 | 11.3.0 · 11.3.1 · 11.3.2 |
| Oracle Communications | Alarms, KPI, and Measurements (Spring Framework) | 23.4.0-23.4.4 | |
| Oracle Communications | Automated Test Suite (Spring Framework) | 24.2.0 | 24.2.0 |
| Oracle Communications | BEServer (Spring Framework) | 24.1.0.0.0 | 24.1.0.0.0 |
| Oracle Communications | Install (Spring Framework) | 23.4.0-23.4.3 | 23.4.2 |
| Oracle Communications | Security (Spring Framework) | 46.6.4, 46.6.5 | 46.6.4 · 46.6.5 |
| Oracle Communications | Signaling (Spring Framework) | 23.4.0 | 23.4.0 · 23.4.3 |
| Oracle Communications | User Interface (Spring Framework) | 9.1.1.8.0 | 9.1.1.8.0 |
| Oracle Communications Applications | Orchestration (Spring Framework) | 12.0.0.4-12.0.0.8, 15.0.0.0 | 15.0.0.0 |
| Oracle Construction and Engineering | Admin (Spring Framework) | 19.12.0-19.12.19, 20.12.0-20.12.14, 21.12.0-21.12.12 | |
| Oracle Construction and Engineering | Document Management (Spring Framework) | 22.12.0-22.12.13, 23.12.0-23.12.6 | |
| Oracle Financial Services Applications | Accessibility (Spring Framework) | 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | 14.4.0.0.0 · 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Authentication (Spring Framework) | 22.1.0.0.0, 22.2.0.0.0 | 22.1.0.0.0 · 22.2.0.0.0 |
| Oracle Financial Services Applications | Base (Spring Framework) | 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | 14.4.0.0.0 · 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Basic Config/Maintenances (Spring Framework) | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Common (Spring Framework) | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Infrastructure (Spring Framework) | 8.0.7, 8.0.8, 8.1.1, 8.1.2 | 8.0.7 · 8.0.8 · 8.1.1 · 8.1.2 · 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Installer (Spring Framework) | 8.0.8.2.8, 8.1.1.1.18, 8.1.2.6.4, 8.1.2.7.3 | 8.0.8.2.8 · 8.1.1.1.18 · 8.1.2.5 · 8.1.2.6 · 8.1.2.6.4 · 8.1.2.7.3 |
| Oracle Financial Services Applications | Platform (Spring Framework) | 8.0.8.0 | 8.0.8.0 · 8.0.8.1 · 8.1.1.1 · 8.1.2.6 · 8.1.2.7 |
| Oracle Financial Services Applications | Reports (Spring Framework) | 8.1.2.6, 8.1.2.7 | 8.1.2.6 · 8.1.2.7 · 14.4.0.0.0 · 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Fusion Middleware | Core (Spring Framework) | 12.2.1.4.0, 14.1.1.0.0 | 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | Fusion Apps (Spring Framework) | 14.1.1.0.0 | 14.1.1.0.0 |
| Oracle Fusion Middleware | Third Party (Spring Framework) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle HealthCare Applications | Core (Spring Framework) | 5.0.0-5.0.9 | |
| Oracle HealthCare Applications | FHIR Server (Spring Framework) | 8.1.4, 8.2.0 | 8.1.4 · 8.2.0 |
| Oracle Insurance Applications | Architecture (Spring Framework) | 11.2.11, 11.3.0-11.3.2 | 11.2.11 |
| Oracle Insurance Applications | Docupresentment IDS Server (Spring Framework) | 12.6.4, 12.7.1 | 12.6.4 · 12.7.1 |
| Oracle MySQL | Monitoring: General (Spring Framework) | 8.0.38 and prior | |
| Oracle Retail Applications | Application Core (Spring Framework) | 15.0.3, 16.0.3 | 15.0.3 · 16.0.3 |
| Oracle Retail Applications | PeopleSoft Integration Bugs (Spring Framework) | 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 | 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1 |
| Oracle Retail Applications | RIB Kernal (Spring Framework) | 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 | 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1 |
| Oracle Systems | Tools (Spring Framework) | 4 | 4 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.springframework:spring-web |
0 | 5.3.34 |
unbounded |
org.springframework:spring-web |
6.0.0 | 6.0.19 |
unbounded |
org.springframework:spring-web |
6.1.0 | 6.1.6 |
unbounded |
Products and versions
1 product, 3 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| osv | org.springframework | spring-web | generic | ＜ 5.3.34 · ≥ 6.0.0 and ＜ 6.0.19 · ≥ 6.1.0 and ＜ 6.1.6 |
References
Timeline
Timeline
| Published | 2024-04-16 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |