CVE-2024-22259

highpriority · track · 1EPSS 0.026 · 85 %ileDEEUFRNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

2.57% (85th) EPSS

CVSS 8.1 · high

Is it mine?

24 products

Check your exposure

Who says so?

8 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-22

Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.

cvss

Technical severity, 0–10. One row per scoring source.

8.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.1highAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Nsecondary · security@vmware.comexploitability 2.8 · impact 5.2

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Nsecondary · OSV

v3.17.7highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:Psecondary · CVSS-BT (t0sche)

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-601USCWE-601USCWE-601USCWE-601US

affected products (24)

Products and version ranges known to be affected.

IBM FileNet Content Manager 5.5.12all versionscert_bundDEcpe:/a:ibm:filenet_content_manager:5.5.12
IBM FileNet Content Manager 5.5.8all versionscert_bundDEcpe:/a:ibm:filenet_content_manager:5.5.8
IBM FileNet Content Manager 5.6.0all versionscert_bundDEcpe:/a:ibm:filenet_content_manager:5.6.0
Oracle Fusion Middleware 12.2.1.19.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:12.2.1.19.0
Oracle Fusion Middleware 12.2.1.4.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:12.2.1.4.0
Oracle Fusion Middleware 14.1.1.0.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:14.1.1.0.0
Oracle Fusion Middleware 8.5.7all versionscert_bundDEcpe:/a:oracle:fusion_middleware:8.5.7
Spring Spring Frameworkall versionsenisa_euvdEU
Spring Spring Framework5.3.x → 5.3.33enisa_euvdEU
Spring Spring Framework6.0.x → 6.0.18enisa_euvdEU
Spring Spring Framework6.1.x → 6.1.5enisa_euvdEU
Pivotal Software Inc. Spring Framework5.3.0 → 5.3.32fstec_bduRU
Pivotal Software Inc. Spring Framework6.0.0 → 6.0.17fstec_bduRU
Pivotal Software Inc. Spring Framework6.1.0 → 6.1.4fstec_bduRU
ООО «НеМо» Программный комплекс информационной системы «Формирование ПД»≤ RU.53305691.00007-03fstec_bduRU
fusion_middlewareall versionsncsc_nlNLcpe:2.3:a:oracle:fusion_middleware:12.2.1.4.0:*:*:*:*:*:*:*
fusion_middleware_mapviewerall versionsncsc_nlNLcpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.4.0:*:*:*:*:*:*:*
netapp active iq unified managerall versionsnvdUScpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:*:*:*
vmware spring framework< 5.3.33nvdUScpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
vmware spring framework6.0.0 → 6.0.18nvdUScpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*

showing 20 of 24

advisories (7)

Vendor and ecosystem advisories describing this.

NCSC-2024-0298 Kwetsbaarheden verholpen in Oracle Fusion MiddlewareNL2024-07-17csaf · ncsc_nlNL
Er zijn kwetsbaarheden verholpen in Oracle Fusion Middleware.
WID-SEC-W-2024-0639VMware Tanzu Spring Framework: Schwachstelle ermöglicht Manipulation von DateienDeutsch2024-03-14csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Framework ausnutzen, um Dateien zu manipulieren oder Informationen offenzulegen.
WID-SEC-W-2024-0869Oracle Communications: Mehrere SchwachstellenDeutsch2024-04-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2024-1313IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2024-06-06csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Dateien zu manipulieren, um einen Denial-of-Service-Zustand erzuegen, um vertrauliche Informationen offenzulegen, um die Sicherheitsmaßnahmen zu umgehen und beliebigen Code auszuführen.
WID-SEC-W-2024-1637Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2024-07-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-hgjh-9rj2-g67jSpring Framework URL Parsing with Host Validation Vulnerability2024-03-16ghsa · osvUS
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243, but with different input.
CERTFR-2026-AVI-1336Multiples vulnérabilités dans les produits IBMFrançais2026-10-16vendor · certfrFR

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl nvd osv certfr NVD CVE.org MITRE

published 2024-03-16modified 2026-06-17

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan