CVE-2025-22233

CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks. Affected Spring Products and Versions Spring Framework: * 6.2.0 - 6.2.6 * 6.1.0 - 6.1.19 * 6.0.0 - 6.0.27 * 5.3.0 - 5.3.42 * Older, unsupported versions are also affected Mitigation Users of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix Version Availability 6.2.x 6.2.7 OSS6.1.x 6.1.20 OSS6.0.x 6.0.28 Commercial https://enterprise.spring.io/ 5.3.x 5.3.43 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. Generally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation. For setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields. Credit This issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N&version=3.1

Configurations

No configuration.

History

19 May 2025, 13:35

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-16 20:15

Updated : 2025-05-19 13:35

NVD link : CVE-2025-22233

Mitre link : CVE-2025-22233

CVE.ORG link : CVE-2025-22233

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-22233", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "published": "2025-05-16T20:15:22.143", "references": [{"url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N&version=3.1", "source": "security@vmware.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks.\n\nAffected Spring Products and Versions\n\nSpring Framework:\n * 6.2.0 - 6.2.6\n\n * 6.1.0 - 6.1.19\n\n * 6.0.0 - 6.0.27\n\n * 5.3.0 - 5.3.42\n * Older, unsupported versions are also affected\n\n\n\nMitigation\n\nUsers of affected versions should upgrade to the corresponding fixed version.\n\nAffected version(s)Fix Version\u00a0Availability\u00a06.2.x\n 6.2.7\nOSS6.1.x\n 6.1.20\nOSS6.0.x\n 6.0.28\n Commercial https://enterprise.spring.io/ 5.3.x\n 5.3.43\n Commercial https://enterprise.spring.io/ \nNo further mitigation steps are necessary.\n\n\nGenerally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation.\n\nFor setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields.\n\nCredit\n\nThis issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation."}, {"lang": "es", "value": "La CVE-2024-38820 garantiz\u00f3 la conversi\u00f3n a min\u00fasculas, independiente de la configuraci\u00f3n regional, tanto para los patrones de disallowedFields configurados como para los nombres de los par\u00e1metros de solicitud. Sin embargo, a\u00fan existen casos en los que es posible omitir las comprobaciones de disallowedFields. Productos y versiones de Spring afectados: Spring Framework: * 6.2.0 - 6.2.6 * 6.1.0 - 6.1.19 * 6.0.0 - 6.0.27 * 5.3.0 - 5.3.42 * Las versiones anteriores sin soporte tambi\u00e9n se ven afectadas. Mitigaci\u00f3n: Los usuarios de las versiones afectadas deben actualizar a la versi\u00f3n corregida correspondiente. Versi\u00f3n(s) afectada(s) Versi\u00f3n de correcci\u00f3n Disponibilidad 6.2.x 6.2.7 OSS6.1.x 6.1.20 OSS6.0.x 6.0.28 Comercial https://enterprise.spring.io/ 5.3.x 5.3.43 Comercial https://enterprise.spring.io/ No se necesitan m\u00e1s medidas de mitigaci\u00f3n. En general, recomendamos usar un objeto de modelo dedicado con propiedades solo para el enlace de datos o usar el enlace del constructor, ya que los argumentos del constructor declaran expl\u00edcitamente qu\u00e9 enlazar junto con la desactivaci\u00f3n del enlace del establecedor a trav\u00e9s del indicador declarativeBinding. Consulte la secci\u00f3n Dise\u00f1o del modelo en la documentaci\u00f3n de referencia. Para el enlace de configuraci\u00f3n, prefiera el uso de allowedFields (una lista expl\u00edcita) en lugar de disallowedFields. Cr\u00e9dito Este problema fue reportado responsablemente por el equipo de desarrollo del marco TERASOLUNA de NTT DATA Group Corporation."}], "lastModified": "2025-05-19T13:35:20.460", "sourceIdentifier": "security@vmware.com"}