CVE-2024-22236

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in the org.springframework.cloud:spring-cloud-contract-shade dependency.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732CWE-377

Affected software

No affected versions have been published.

Timeline

Published
Jan 31, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-222377.8Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for NetworksCVE-2024-222384.8Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject maCVE-2024-222397.8Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for NetworksCVE-2024-22249.8Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GrCVE-2024-222404.9Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerabilitCVE-2024-222414.8Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious pCVE-2024-222438.1Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checkCVE-2024-222446.1Open Redirect in Harbor  <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site.CVE-2024-222459.6Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allowCVE-2024-222467.4VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution. A malicious acCVE-2024-222474.8VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability. A malicious actor with physical access to the CVE-2024-222487.1VMware SD-WAN Orchestrator contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker cont