CVE-2024-22243 @ Maven-org.springframework:spring-web-3.2.4.RELEASE

[cxronen]

Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about CVE-2024-22243
Checkmarx Project: cxronen/BookStore_VSCode
Repository URL: https://github.com/cxronen/BookStore_VSCode
Branch: master
Scan ID: 3aaa12b3-552a-4874-ba98-3d364d7d56f6

---

Applications that use "UriComponentsBuilder" to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to an Open Redirect attack or a SSRF attack if the URL is used after passing validation checks. This issue affects org.springframework:spring-web versions through 5.3.31, 6.0.0-M1 through 6.0.16, and 6.1.0-M1 through 6.1.3.

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: NONE
Remediation Upgrade Recommendation: 6.0.19