CVE-2024-22259 @ Maven-org.springframework:spring-web-5.3.10

[SamHeadrickCx]

Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about CVE-2024-22259
Checkmarx Project: SamHeadrickCx/easybuggy4sb
Repository URL: https://github.com/SamHeadrickCx/easybuggy4sb
Branch: master
Scan ID: 94cbf8fd-fbe8-49c7-9c55-da0658f9cbfc

---

Applications that use "UriComponentsBuilder" in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to an open redirect attack or an SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22243, but with different input. This issue affects org.springframework:spring-web versions through 5.3.32, 6.0.0-M1 through 6.0.17, and 6.1.0-M1 through 6.1.4.

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: NONE
Remediation Upgrade Recommendation: 5.3.38-atlassian-1