CVE-2024-22236

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in the org.springframework.cloud:spring-cloud-contract-shade dependency.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732 CWE-377

Affected software

Vendor	Product	Versions
Spring	Spring Cloud Contract	>= 4.1.0, < 4.1.1; >= 4.0.0, < 4.0.6; >= 3.1.0, < 3.1.10

References

https://spring.io/security/cve-2024-22236Vendor Advisory
https://spring.io/security/cve-2024-22236Vendor Advisory

Timeline

Published: Jan 31, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-222377.8Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks CVE-2024-222384.8Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject ma CVE-2024-222397.8Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks CVE-2024-22249.8Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender Gr CVE-2024-222404.9Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerabilit CVE-2024-222414.8Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious p CVE-2024-222438.1Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation check CVE-2024-222446.1Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site.CVE-2024-222459.6Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow CVE-2024-222467.4VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution. A malicious ac CVE-2024-222474.8VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability. A malicious actor with physical access to the CVE-2024-222487.1VMware SD-WAN Orchestrator contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker cont