CVE-2022-22968

MediumCVSS 5.3/10Last modified Oct 8, 2026

Description

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-178

Affected software

Vendor	Product	Versions
n/a	Spring Framework	Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions

References

https://security.netapp.com/advisory/ntap-20220602-0004/Third Party Advisory
https://tanzu.vmware.com/security/cve-2022-22968Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
https://security.netapp.com/advisory/ntap-20220602-0004/Third Party Advisory
https://tanzu.vmware.com/security/cve-2022-22968Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory

Timeline

Published: Apr 14, 2022
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-229696.5<Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Servic CVE-2022-22978.8A vulnerability, which was classified as critical, was found in SourceCodester Clinics Patient Management System 2.0. Affected is an unknown CVE-2022-229705.3In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable t CVE-2022-229716.5In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vu CVE-2022-229729.8VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain CVE-2022-229737.8VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escal CVE-2022-229756.6An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack CVE-2022-229765.3Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerabil CVE-2022-229777.1VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administ CVE-2022-229789.8In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigure CVE-2022-229797.5In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functional CVE-2022-22989.8A vulnerability has been found in SourceCodester Clinics Patient Management System 2.0 and classified as critical. Affected by this vulnerab