CVE-2024-22243 @ Maven-org.springframework:spring-web-5.3.10

[SamHeadrickCx]

Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about CVE-2024-22243
Checkmarx Project: SamHeadrickCx/easybuggy4sb
Repository URL: https://github.com/SamHeadrickCx/easybuggy4sb
Branch: master
Scan ID: 94cbf8fd-fbe8-49c7-9c55-da0658f9cbfc

---

Applications that use "UriComponentsBuilder" to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to an Open Redirect attack or a SSRF attack if the URL is used after passing validation checks. This issue affects org.springframework:spring-web versions through 5.3.31, 6.0.0-M1 through 6.0.16, and 6.1.0-M1 through 6.1.3.

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: NONE
Remediation Upgrade Recommendation: 5.3.38-atlassian-1