CVE-2010-1622
Fixed in a distro release EPSS 52%
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.
Products: oracle fusion_middleware, springsource spring_framework
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework:spring | 2.5.7 |
| Maven | org.springframework:spring | 3.0.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat jboss web framework kit 1 | jboss-wfk-1.0.0-uninstall | 0:1.0.0-3.ep5.el4 |