CVE-2021-22118
mediumPriorität · verfolgen · 31EPSS 0.004 · 32. PerzentilEUFRRUUSEPSS · bewertet 2026-10-27
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.6–7.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (56)
Betroffene Produkte und Versionsbereiche.
- n/a Spring Framework≤ Spring Framework versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7enisa_euvdEU
- netapp management services for element softwarealle VersionennvdUScpe:2.3:a:netapp:management_services_for_element_software:*:*:*:*:*:*:*:*
- oracle communications brm - elastic charging engine= 12.0.0.3nvdUScpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:*
- oracle communications cloud native core binding support function= 1.9.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:*:*:*:*:*:*:*:*
- oracle communications cloud native core policy= 1.14.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_policy:*:*:*:*:*:*:*:*
- oracle communications cloud native core security edge protection proxy= 1.6.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:*:*:*:*:*:*:*:*
- oracle communications cloud native core service communication proxy= 1.14.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:*:*:*:*:*:*:*:*
- oracle communications cloud native core unified data repository= 1.14.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:*:*:*:*:*:*:*:*
- oracle communications diameter intelligence hub8.0.0 → 8.1.0nvdUScpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*
- oracle communications diameter intelligence hub8.2.0 → 8.2.3nvdUScpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*
- oracle communications element manager8.2.0 → 8.2.4.0nvdUScpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*
- oracle communications interactive session recorder= 6.4nvdUScpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:*
- oracle communications network integrity= 7.3.6nvdUScpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:*
- oracle communications session report manager8.0.0 → 8.2.4.0nvdUScpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-gfwj-fwqj-fp3vImproper Privilege Management in Spring Framework2022-05-24ghsa · osvUS
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- CERTFR-2026-AVI-1336Multiples vulnérabilités dans les produits IBMFrançais2026-10-16vendor · certfrFR
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (38)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/spring-projects/spring-frameworkPatchcnnvd
- https://packetstormsecurity.com/files/165134/Red-Hat-Security-Advisory-2021-4918-03.htmlcnnvd
- https://security.netapp.com/advisory/ntap-20210713-0005/cnnvd
- https://tanzu.vmware.com/security/cve-2021-22118cnnvd
- https://vigilance.fr/vulnerability/Spring-Framework-read-write-access-via-WebFlux-Temporary-Storage-35532cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.4105cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.4253cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021053107cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan