CVE-2021-22118

Fixed upstream EPSS <1%

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.

Published 2021-05-27 · CVE record · OSV

Products: vmware spring_framework, oracle commerce_guided_search, oracle communications_brm_-_elastic_charging_engine, oracle communications_cloud_native_core_binding_support_function, oracle communications_cloud_native_core_policy, oracle communications_cloud_native_core_security_edge_protection_proxy, oracle communications_cloud_native_core_service_communication_proxy, oracle communications_cloud_native_core_unified_data_repository, oracle communications_diameter_intelligence_hub, oracle communications_element_manager, oracle communications_interactive_session_recorder, oracle communications_network_integrity, oracle communications_session_report_manager, oracle communications_session_route_manager, oracle communications_unified_inventory_management, oracle documaker, oracle enterprise_data_quality, oracle financial_services_analytical_applications_infrastructure, oracle healthcare_data_repository, oracle insurance_policy_administration, oracle insurance_rules_palette, oracle mysql_enterprise_monitor, oracle retail_assortment_planning, oracle retail_customer_management_and_segmentation_foundation, oracle retail_financial_integration, oracle retail_integration_bus, oracle retail_merchandising_system, oracle retail_order_broker, oracle retail_predictive_application_server, oracle utilities_testing_accelerator, netapp hci, netapp management_services_for_element_software

Fixed upstream

Distro releases