CVE-2022-22970

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

Score

CVSS 3.1 5.3 Medium

Status

Modified - security@vmware.com

Published

2022-05-12

Last modified

2026-10-08

Weaknesses

CWE-770

Affected products

• Active Iq Unified Manager (Netapp)
• Brocade San Navigator (Netapp)
• Cloud Secure Agent (Netapp)
• Oncommand Insight (Netapp)
• Financial Services Crime And Compliance Management Studio (Oracle)
• Spring Framework (Vmware)

References

• https://tanzu.vmware.com/security/cve-2022-22970
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://security.netapp.com/advisory/ntap-20220616-0006/