CVE-2021-22096

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-117

Affected software

Vendor	Product	Versions
n/a	Spring Framework	Spring Framework versions 5.3.x prior to 5.3.12+, 5.2.x prior to 5.2.18+ and all older unsupported versions are impacted.

References

https://security.netapp.com/advisory/ntap-20211125-0005/Third Party Advisory
https://tanzu.vmware.com/security/cve-2021-22096Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlThird Party Advisory
https://security.netapp.com/advisory/ntap-20211125-0005/Third Party Advisory
https://tanzu.vmware.com/security/cve-2021-22096Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlThird Party Advisory

Timeline

Published: Oct 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-220976.5In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body CVE-2021-220986.1UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious user can exploit the open redirect vulnera CVE-2021-22108.2Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Quotes). Supported versions that are affected ar CVE-2021-221005.3In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally CVE-2021-221017.5Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated a CVE-2021-22115.9Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affec CVE-2021-221128.8Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to CVE-2021-221135.3Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing CVE-2021-221145.3Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that CVE-2021-221156.5Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed. C CVE-2021-221167.5RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client con CVE-2021-221177.8RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with suffi