GHSA-2r2v-q399-qq93

ghsaUSosv

Request injection in Spring Cloud Gateway

view advisory published 2021-11-10Licence: CC-BY-4.0

Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-22051US	medium6.5OT elevated	0.69% (53rd)	—	2021-11-08
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should a…

references

External citations — patches, advisories, analysis.

https://nvd.nist.gov/vuln/detail/CVE-2021-22051ADVISORY
https://tanzu.vmware.com/security/cve-2021-22051WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan