CVE-2022-22971

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

Score

CVSS 3.1 6.5 Medium

Status

Modified - security@vmware.com

Published

2022-05-12

Last modified

2026-10-08

Weaknesses

CWE-770

Affected products

• Cloud Secure Agent (Netapp)
• Oncommand Insight (Netapp)
• Financial Services Crime And Compliance Management Studio (Oracle)
• Spring Framework (Vmware)

References

• https://tanzu.vmware.com/security/cve-2022-22971
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://security.netapp.com/advisory/ntap-20220616-0003/