{"id":"CVE-2024-22262","published":"2024-04-16T05:54:12Z","modified":"2025-02-13T17:33:40Z","title":"CVE-2024-22262: Spring Framework URL Parsing with Host Validation","vendor":"Spring","product":"Spring Framework","tier":"tail","description":{"text":"Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n\nThis is the same as  CVE-2024-22259 https://spring.io/security/cve-2024-22259  and  CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01191,"percentile":0.67934,"provenance":"source"},"cwes":[{"id":"CWE-601","name":"URL Redirection to Untrusted Site"},{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://spring.io/security/cve-2024-22262","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20240524-0003/","tags":[]}],"priority":{"score":19.3,"factors":[{"name":"EPSS percentile","points":13.59},{"name":"CVSS severity","points":5.67}]},"vendorSlug":"spring","affectedVersions":[{"vendor":"Spring","product":"Spring Framework","versions":[">= 6.1.x, < 6.1.6",">= 6.0.x, < 6.0.19",">= 5.3.x, < 5.3.34"]}],"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-web","vulnerableRanges":["<5.3.34",">=6.0.0, <6.0.19",">=6.1.0, <6.1.6"],"patched":["5.3.34","6.0.19","6.1.6"],"from":["GHSA-2wrp-6fg6-hmc5"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1071","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-spring-framework-cve-2015-5211","packageHistory":[{"cve":"CVE-2016-1000027","published":"2020-01-02","fixed":"6.0.0","kev":false},{"cve":"CVE-2024-22243","published":"2024-02-23","fixed":"6.1.4","kev":false},{"cve":"CVE-2024-22259","published":"2024-03-16","fixed":"6.1.5","kev":false,"link":{"from":"CVE-2024-22259","to":"CVE-2024-22262","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-web","fromFixed":"5.3.33","toFixed":"5.3.34","daysApart":31},{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-web","fromFixed":"6.0.18","toFixed":"6.0.19","daysApart":31},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2024-22262","published":"2024-04-16","fixed":"6.1.6","kev":false},{"cve":"CVE-2024-38809","published":"2024-09-27","fixed":"6.1.12","kev":false,"link":{"from":"CVE-2024-22262","to":"CVE-2024-38809","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-web","fromFixed":"5.3.34","toFixed":"5.3.38","daysApart":164},{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-web","fromFixed":"6.0.19","toFixed":"6.0.23","daysApart":164}]}},{"cve":"CVE-2024-38820","published":"2024-10-18","fixed":"6.1.14","kev":false},{"cve":"CVE-2025-41234","published":"2025-06-12","fixed":"6.2.8","kev":false}],"package":"Maven:org.springframework:spring-web"}}