CVE-2025-22233

{
  "id": "CVE-2025-22233",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-22233",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-17T02:36:53.736871Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.1,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Spring",
          "product": "Spring Framework",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.0",
              "versionType": "Framework",
              "lessThanOrEqual": "6.2.6"
            },
            {
              "status": "affected",
              "version": "6.1.0",
              "versionType": "Framework",
              "lessThanOrEqual": "6.1.19"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "versionType": "Enterprise Framework",
              "lessThanOrEqual": "6.0.27"
            },
            {
              "status": "affected",
              "version": "5.3.0",
              "versionType": "Enterprise Framework",
              "lessThanOrEqual": "5.3.42"
            },
            {
              "status": "unaffected",
              "version": "6.2.7",
              "versionType": "Framework"
            },
            {
              "status": "unaffected",
              "version": "6.1.20",
              "versionType": "Framework"
            },
            {
              "status": "unaffected",
              "version": "6.0.28",
              "versionType": "Enterprise Framework"
            },
            {
              "status": "unaffected",
              "version": "5.3.43",
              "versionType": "Entrprise Framework"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-05-16T20:15:22.143",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N&version=3.1",
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@vmware.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks.\n\nAffected Spring Products and Versions\n\nSpring Framework:\n  *  6.2.0 - 6.2.6\n\n  *  6.1.0 - 6.1.19\n\n  *  6.0.0 - 6.0.27\n\n  *  5.3.0 - 5.3.42\n  *  Older, unsupported versions are also affected\n\n\n\nMitigation\n\nUsers of affected versions should upgrade to the corresponding fixed version.\n\nAffected version(s)Fix Version Availability 6.2.x\n 6.2.7\nOSS6.1.x\n 6.1.20\nOSS6.0.x\n 6.0.28\n Commercial https://enterprise.spring.io/ 5.3.x\n 5.3.43\n Commercial https://enterprise.spring.io/ \nNo further mitigation steps are necessary.\n\n\nGenerally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation.\n\nFor setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields.\n\nCredit\n\nThis issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation."
    },
    {
      "lang": "es",
      "value": "La CVE-2024-38820 garantizó la conversión a minúsculas, independiente de la configuración regional, tanto para los patrones de disallowedFields configurados como para los nombres de los parámetros de solicitud. Sin embargo, aún existen casos en los que es posible omitir las comprobaciones de disallowedFields. Productos y versiones de Spring afectados: Spring Framework: * 6.2.0 - 6.2.6 * 6.1.0 - 6.1.19 * 6.0.0 - 6.0.27 * 5.3.0 - 5.3.42 * Las versiones anteriores sin soporte también se ven afectadas. Mitigación: Los usuarios de las versiones afectadas deben actualizar a la versión corregida correspondiente. Versión(s) afectada(s) Versión de corrección Disponibilidad 6.2.x 6.2.7 OSS6.1.x 6.1.20 OSS6.0.x 6.0.28 Comercial https://enterprise.spring.io/ 5.3.x 5.3.43 Comercial https://enterprise.spring.io/ No se necesitan más medidas de mitigación. En general, recomendamos usar un objeto de modelo dedicado con propiedades solo para el enlace de datos o usar el enlace del constructor, ya que los argumentos del constructor declaran explícitamente qué enlazar junto con la desactivación del enlace del establecedor a través del indicador declarativeBinding. Consulte la sección Diseño del modelo en la documentación de referencia. Para el enlace de configuración, prefiera el uso de allowedFields (una lista explícita) en lugar de disallowedFields. Crédito Este problema fue reportado responsablemente por el equipo de desarrollo del marco TERASOLUNA de NTT DATA Group Corporation."
    }
  ],
  "lastModified": "2026-06-17T08:45:47.490",
  "sourceIdentifier": "security@vmware.com"
}