nexmo-spring-boot-autoconfigure-1.1.0.jar: 14 vulnerabilities (highest severity is: 9.8) unreachable

[mend-for-github-com]

Vulnerable Library - nexmo-spring-boot-autoconfigure-1.1.0.jar

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-context/5.1.6.RELEASE/spring-context-5.1.6.RELEASE.jar

Vulnerabilities

Vulnerability	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (nexmo-spring-boot-autoconfigure version)	Remediation Possible**	Reachability
CVE-2022-22965	Critical	9.8	High	94.428%	spring-beans-5.1.6.RELEASE.jar	Transitive	N/A*	❌	Unreachable
CVE-2025-41249	High	7.5	Not Defined	0.083%	spring-core-5.1.6.RELEASE.jar	Transitive	N/A*	❌	Unreachable
CVE-2023-20863	Medium	6.5	Not Defined	1.183%	spring-expression-5.1.6.RELEASE.jar	Transitive	N/A*	❌	Unreachable
CVE-2023-20861	Medium	6.5	Not Defined	0.542%	spring-expression-5.1.6.RELEASE.jar	Transitive	N/A*	❌	Unreachable
CVE-2022-22950	Medium	6.5	Not Defined	4.122%	spring-expression-5.1.6.RELEASE.jar	Transitive	N/A*	❌	Unreachable
CVE-2025-41242	Medium	5.9	Not Defined	5.222%	spring-beans-5.1.6.RELEASE.jar	Transitive	N/A*	❌	Unreachable
CVE-2022-24329	Medium	5.3	Not Defined	0.003%	kotlin-stdlib-1.3.31.jar	Transitive	N/A*	❌	Unreachable
CVE-2022-22970	Medium	5.3	Not Defined	0.164%	detected in multiple dependencies	Transitive	N/A*	❌	Unreachable
CVE-2022-22968	Medium	5.3	Not Defined	20.519%	spring-context-5.1.6.RELEASE.jar	Transitive	N/A*	❌	Unreachable
CVE-2020-29582	Medium	5.3	Not Defined	0.004%	kotlin-stdlib-1.3.31.jar	Transitive	N/A*	❌	Unreachable
CVE-2020-15250	Medium	4.4	Not Defined	0.056%	junit-4.12.jar	Transitive	N/A*	❌	Unreachable
CVE-2024-38808	Medium	4.3	Not Defined	0.809%	spring-expression-5.1.6.RELEASE.jar	Transitive	N/A*	❌	Unreachable
CVE-2025-22233	Low	3.1	Not Defined	0.083%	spring-context-5.1.6.RELEASE.jar	Transitive	N/A*	❌	Unreachable
CVE-2024-38820	Low	3.1	Not Defined	1.514%	spring-context-5.1.6.RELEASE.jar	Transitive	N/A*	❌	Unreachable

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-22965

Vulnerable Library - spring-beans-5.1.6.RELEASE.jar

Spring Beans

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /nexmo-spring-boot-test-application/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-beans/5.1.6.RELEASE/spring-beans-5.1.6.RELEASE.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • spring-boot-2.1.4.RELEASE.jar
    • spring-context-5.1.6.RELEASE.jar
      • ❌ spring-beans-5.1.6.RELEASE.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2022-04-01

URL: CVE-2022-22965

Threat Assessment

Exploit Maturity: High

EPSS: 94.428%

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

Release Date: 2022-04-01

Fix Resolution: org.springframework:spring-beans:5.2.20.RELEASE,5.3.18

CVE-2025-41249

Vulnerable Library - spring-core-5.1.6.RELEASE.jar

Spring Core

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /nexmo-spring-boot-test-application/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-core/5.1.6.RELEASE/spring-core-5.1.6.RELEASE.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • spring-boot-2.1.4.RELEASE.jar
    • ❌ spring-core-5.1.6.RELEASE.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-09-16

URL: CVE-2025-41249

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.083%

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2025-41249

Release Date: 2025-09-14

Fix Resolution: https://github.com/spring-projects/spring-framework.git - v6.2.11,org.springframework:spring-core:6.2.11

CVE-2023-20863

Vulnerable Library - spring-expression-5.1.6.RELEASE.jar

Spring Expression Language (SpEL)

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /nexmo-spring-boot-autoconfigure/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-expression/5.1.6.RELEASE/spring-expression-5.1.6.RELEASE.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • spring-boot-2.1.4.RELEASE.jar
    • spring-context-5.1.6.RELEASE.jar
      • ❌ spring-expression-5.1.6.RELEASE.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

Publish Date: 2023-04-13

URL: CVE-2023-20863

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 1.183%

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-20863

Release Date: 2023-04-13

Fix Resolution: org.springframework:spring-expression - 5.2.24.RELEASE,5.3.27,6.0.8

CVE-2023-20861

Vulnerable Library - spring-expression-5.1.6.RELEASE.jar

Spring Expression Language (SpEL)

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /nexmo-spring-boot-autoconfigure/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-expression/5.1.6.RELEASE/spring-expression-5.1.6.RELEASE.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • spring-boot-2.1.4.RELEASE.jar
    • spring-context-5.1.6.RELEASE.jar
      • ❌ spring-expression-5.1.6.RELEASE.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

Publish Date: 2023-03-23

URL: CVE-2023-20861

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.542%

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-20861

Release Date: 2023-03-23

Fix Resolution: org.springframework:spring-expression:x5.2.23.RELEASE,5.3.26,6.0.7

CVE-2022-22950

Vulnerable Library - spring-expression-5.1.6.RELEASE.jar

Spring Expression Language (SpEL)

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /nexmo-spring-boot-autoconfigure/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-expression/5.1.6.RELEASE/spring-expression-5.1.6.RELEASE.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • spring-boot-2.1.4.RELEASE.jar
    • spring-context-5.1.6.RELEASE.jar
      • ❌ spring-expression-5.1.6.RELEASE.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

Publish Date: 2022-04-01

URL: CVE-2022-22950

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 4.122%

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tanzu.vmware.com/security/cve-2022-22950

Release Date: 2022-04-01

Fix Resolution: org.springframework:spring-expression:5.2.20,5.3.17

CVE-2025-41242

Vulnerable Library - spring-beans-5.1.6.RELEASE.jar

Spring Beans

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /nexmo-spring-boot-test-application/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-beans/5.1.6.RELEASE/spring-beans-5.1.6.RELEASE.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • spring-boot-2.1.4.RELEASE.jar
    • spring-context-5.1.6.RELEASE.jar
      • ❌ spring-beans-5.1.6.RELEASE.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.
An application can be vulnerable when all the following are true:

• the application is deployed as a WAR or with an embedded Servlet container
• the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization
• the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling
  We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.

Publish Date: 2025-08-18

URL: CVE-2025-41242

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 5.222%

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-08-18

Fix Resolution: https://github.com/spring-projects/spring-framework.git - v6.2.10,org.springframework:spring-beans:6.2.10

CVE-2022-24329

Vulnerable Library - kotlin-stdlib-1.3.31.jar

Kotlin Standard Library for JVM

Library home page: https://kotlinlang.org/

Path to dependency file: /nexmo-spring-boot-autoconfigure/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/jetbrains/kotlin/kotlin-stdlib/1.3.31/kotlin-stdlib-1.3.31.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • kotlin-stdlib-jdk8-1.3.31.jar
    • ❌ kotlin-stdlib-1.3.31.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.

Publish Date: 2022-02-25

URL: CVE-2022-24329

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.003%

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2qp4-g3q3-f92w

Release Date: 2022-02-25

Fix Resolution: org.jetbrains.kotlin:kotlin-stdlib:1.6.0

CVE-2022-22970

Vulnerable Libraries - spring-beans-5.1.6.RELEASE.jar, spring-core-5.1.6.RELEASE.jar

spring-beans-5.1.6.RELEASE.jar

Spring Beans

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /nexmo-spring-boot-test-application/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-beans/5.1.6.RELEASE/spring-beans-5.1.6.RELEASE.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • spring-boot-2.1.4.RELEASE.jar
    • spring-context-5.1.6.RELEASE.jar
      • ❌ spring-beans-5.1.6.RELEASE.jar (Vulnerable Library)

spring-core-5.1.6.RELEASE.jar

Spring Core

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /nexmo-spring-boot-test-application/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-core/5.1.6.RELEASE/spring-core-5.1.6.RELEASE.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • spring-boot-2.1.4.RELEASE.jar
    • ❌ spring-core-5.1.6.RELEASE.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

Publish Date: 2022-05-12

URL: CVE-2022-22970

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.164%

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tanzu.vmware.com/security/cve-2022-22970

Release Date: 2022-05-12

Fix Resolution: org.springframework:spring-beans:5.2.22,5.3.20;org.springframework:spring-core:5.2.22,5.3.20

CVE-2022-22968

Vulnerable Library - spring-context-5.1.6.RELEASE.jar

Spring Context

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /nexmo-spring-boot-autoconfigure/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-context/5.1.6.RELEASE/spring-context-5.1.6.RELEASE.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • spring-boot-2.1.4.RELEASE.jar
    • ❌ spring-context-5.1.6.RELEASE.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

Publish Date: 2022-04-14

URL: CVE-2022-22968

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 20.519%

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tanzu.vmware.com/security/cve-2022-22968

Release Date: 2022-04-14

Fix Resolution: org.springframework:spring-context:5.2.21,5.3.19

CVE-2020-29582

Vulnerable Library - kotlin-stdlib-1.3.31.jar

Kotlin Standard Library for JVM

Library home page: https://kotlinlang.org/

Path to dependency file: /nexmo-spring-boot-autoconfigure/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/jetbrains/kotlin/kotlin-stdlib/1.3.31/kotlin-stdlib-1.3.31.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • kotlin-stdlib-jdk8-1.3.31.jar
    • ❌ kotlin-stdlib-1.3.31.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.

Publish Date: 2021-02-03

URL: CVE-2020-29582

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.004%

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cqj8-47ch-rvvq

Release Date: 2021-02-03

Fix Resolution: org.jetbrains.kotlin:kotlin-stdlib:1.4.21

CVE-2020-15250

Vulnerable Library - junit-4.12.jar

JUnit is a unit testing framework for Java, created by Erich Gamma and Kent Beck.

Library home page: http://www.junit.org

Path to dependency file: /nexmo-spring-boot-test-application/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/junit/junit/4.12/junit-4.12.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • kotlin-test-junit-1.3.31.jar
    • ❌ junit-4.12.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.

Publish Date: 2020-10-12

URL: CVE-2020-15250

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.056%

CVSS 3 Score Details (4.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-269g-pwp5-87pp

Release Date: 2020-10-12

Fix Resolution: junit:junit:4.13.1

CVE-2024-38808

Vulnerable Library - spring-expression-5.1.6.RELEASE.jar

Spring Expression Language (SpEL)

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /nexmo-spring-boot-autoconfigure/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-expression/5.1.6.RELEASE/spring-expression-5.1.6.RELEASE.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • spring-boot-2.1.4.RELEASE.jar
    • spring-context-5.1.6.RELEASE.jar
      • ❌ spring-expression-5.1.6.RELEASE.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.
Specifically, an application is vulnerable when the following is true:

• The application evaluates user-supplied SpEL expressions.
  Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2024-08-20

URL: CVE-2024-38808

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.809%

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-38808

Release Date: 2024-08-20

Fix Resolution: org.springframework:spring-expression:5.3.39

CVE-2025-22233

Vulnerable Library - spring-context-5.1.6.RELEASE.jar

Spring Context

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /nexmo-spring-boot-autoconfigure/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-context/5.1.6.RELEASE/spring-context-5.1.6.RELEASE.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • spring-boot-2.1.4.RELEASE.jar
    • ❌ spring-context-5.1.6.RELEASE.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks.
Affected Spring Products and Versions
Spring Framework:

• 6.2.0 - 6.2.6
• 6.1.0 - 6.1.19
• 6.0.0 - 6.0.27
• 5.3.0 - 5.3.42
• Older, unsupported versions are also affected
  Mitigation
  Users of affected versions should upgrade to the corresponding fixed version.
  Affected version(s)Fix Version Availability 6.2.x
  6.2.7
  OSS6.1.x
  6.1.20
  OSS6.0.x
  6.0.28
  Commercial https://enterprise.spring.io/ 5.3.x
  5.3.43
  Commercial https://enterprise.spring.io/
  No further mitigation steps are necessary.
  Generally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation.
  For setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields.
  Credit
  This issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation.

Publish Date: 2025-05-16

URL: CVE-2025-22233

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.083%

CVSS 3 Score Details (3.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2025-22233

Release Date: 2025-05-16

Fix Resolution: https://github.com/spring-projects/spring-framework.git - v6.1.20 ,org.springframework:spring-context:6.1.20,org.springframework:spring-context:6.2.7,https://github.com/spring-projects/spring-framework.git - v6.2.7

CVE-2024-38820

Vulnerable Library - spring-context-5.1.6.RELEASE.jar

Spring Context

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /nexmo-spring-boot-autoconfigure/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-context/5.1.6.RELEASE/spring-context-5.1.6.RELEASE.jar

Dependency Hierarchy:

• nexmo-spring-boot-autoconfigure-1.1.0.jar (Root Library)
  • spring-boot-2.1.4.RELEASE.jar
    • ❌ spring-context-5.1.6.RELEASE.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

Publish Date: 2024-10-18

URL: CVE-2024-38820

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 1.514%

CVSS 3 Score Details (3.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-38820

Release Date: 2024-10-18

Fix Resolution: org.springframework:spring-context:6.1.14

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-for-github-com]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.