Spring Web vulnerable to Open Redirect or Server Side Request Forgery
High severity
GitHub Reviewed
Published
Feb 23, 2024
to the GitHub Advisory Database
•
Updated Feb 28, 2024
Package
Affected versions
>= 6.1.0, < 6.1.4
>= 6.0.0, < 6.0.17
>= 5.3.0, < 5.3.32
<= 5.2.25.RELEASE
Patched versions
6.1.4
6.0.17
5.3.32
Description
Published by the National Vulnerability Database
Feb 23, 2024
Published to the GitHub Advisory Database
Feb 23, 2024
Reviewed
Feb 23, 2024
Last updated
Feb 28, 2024
Credits
-
yoshizawa-masatoshi Analyst
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks.
References