Description
Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- Spring / Spring Framework7.0.0 – 7.0.8
- Spring / Spring Framework6.2.0 – 6.2.19
- Spring / Spring Framework6.1.0 – 6.1.28
- Spring / Spring Framework6.0.0 – 6.0.30
- Spring / Spring Framework5.3.0 – 5.3.49
- Spring / Spring Framework0 – 5.2.25.RELEASE
- VMware / Spring Framework5.2.26
References
Updated 5m ago · 8 sources