CVE-2025-22235
highpriority · track · 10OT risk · elevatedEPSS 0.004 · 37 %ileexploit · PoCDEEUUSEPSS · scored 2026-10-22
EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: * You use Spring Security * EndpointRequest.to() has been used in a Spring Security chain configuration * The endpoint which EndpointRequest references is disabled or not exposed via web * Your application handles requests to /null and this path needs protection You are not affected if any of the following is true: * You don't use Spring Security * You don't use EndpointRequest.to() * The endpoint which EndpointRequest.to() refers to is enabled and is exposed * Your application does not handle requests to /null or this path does not need protection
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- idealzh/cve-2025-22235-demoidealzh/cve-2025-22235-demoPoC · poc_in_github
affected products (17)
Products and version ranges known to be affected.
- Maven org.springframework.boot:spring-boot≤ 2.7.24.2osvUSpkg:maven/org.springframework.boot/spring-boot
- Maven org.springframework.boot:spring-boot3.1.0 → 3.1.15.2osvUSpkg:maven/org.springframework.boot/spring-boot
- Maven org.springframework.boot:spring-boot3.2.0 → 3.2.13.2osvUSpkg:maven/org.springframework.boot/spring-boot
- Maven org.springframework.boot:spring-boot3.3.0 → 3.3.11osvUSpkg:maven/org.springframework.boot/spring-boot
- Maven org.springframework.boot:spring-boot3.4.0 → 3.4.5osvUSpkg:maven/org.springframework.boot/spring-boot
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-0887VMware Tanzu Spring Boot: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2025-04-24csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Boot ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder nicht näher beschriebene Auswirkungen zu erzielen.
- WID-SEC-W-2026-0351Dell NetWorker (Third Party Components): Mehrere SchwachstellenDeutsch2026-02-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell NetWorker ausnutzen, um Angriffe zu starten, die die Integrität, Vertraulichkeit und Verfügbarkeit von Systemen beeinträchtigen.
- GHSA-rc42-6c7j-7h5rSpring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed2025-04-28ghsa · osvUS
EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: * You use Spring Security * EndpointRequest.to() has been used in a Spring Security chain configuration * The endpoint which EndpointRequest references is disabled or not exposed via web * Your application handles requests to /null and this path needs protection You are not affected if any of the following is true: * You don't use Spring Security * You don't use EndpointRequest.to() * The endpoint which EndpointRequest.to() refers to is enabled and is exposed * Your application does not handle requests to /null or this path does not need protection
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan