{
"id": "GHSA-6gf2-pvqw-37ph",
"aliases": [
"CVE-2021-22060"
],
"details": "In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.",
"summary": "Log entry injection in Spring Framework",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.3.0"
},
{
"fixed": "5.3.14"
}
]
}
],
"package": {
"name": "org.springframework:spring-core",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.2.19"
}
]
}
],
"package": {
"name": "org.springframework:spring-core",
"ecosystem": "Maven"
}
}
],
"modified": "2022-01-18T22:38:44Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"published": "2022-01-12T23:04:06Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22060",
"type": "ADVISORY"
},
{
"url": "https://tanzu.vmware.com/security/cve-2021-22060",
"type": "WEB"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2022-01-10T14:10:00Z",
"github_reviewed_at": "2022-01-11T18:50:39Z"
}
}