CVE-2021-22051

Published: Nov 8, 2021Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.

Affected (2)

Products: Vmware: Spring Cloud Gateway

1 product

Spring Cloud Gateway

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Vmware Spring Cloud Gateway	Before 2.2.10
Vmware Spring Cloud Gateway	From 3.0.0 to 3.0.5

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://tanzu.vmware.com/security/cve-2021-22051

Source: security@vmware.com

Vendor Advisory

https://tanzu.vmware.com/security/cve-2021-22051

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.