All Vulnerability Reports

CVE-2022-22971: Spring Framework DoS with STOMP over WebSocket

Severity

Medium

Vendor

Spring by VMware

Description

A Spring application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

Affected VMware Products and Versions

Severity is medium unless otherwise noted.

• Spring Framework
  • 5.3.0 to 5.3.19
  • 5.2.0 to 5.2.21
  • Older, unsupported versions are also affected

Mitigation

Users of affected versions should apply the following mitigation: 5.3.x users should upgrade to 5.3.20; 5.2.x users should upgrade to 5.2.22. No other steps are necessary. Releases that have fixed this issue include:

• Spring Framework
  • 5.3.20
  • 5.2.22

Credit

This vulnerability was responsibly reported to VMware by David Delbecq and Rémy Vermeiren from HMS Industrial Networks, Business Unit Ewon, R&D Department - Software.

References

• https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

History

2022-05-11: Initial vulnerability report published.