CVE-2021-22096

Published: Oct 28, 2021Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

Affected (11)

Products: Vmware: Spring Framework · Netapp: Active Iq Unified Manager, Management Services For Element Software And Netapp Hci, Metrocluster Tiebreaker, Snap Creator Framework, Snapcenter · Oracle: Communications Cloud Native Core Console, Communications Cloud Native Core Service Communication Proxy

Vmware

1 product

Spring Framework

Netapp

5 products

Active Iq Unified Manager

Management Services For Element Software And Netapp Hci

Metrocluster Tiebreaker

Snap Creator Framework

Snapcenter

Oracle

2 products

Communications Cloud Native Core Console

Communications Cloud Native Core Service Communication Proxy

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Vmware Spring Framework	From 5.2.0 to 5.2.17
Vmware Spring Framework	From 5.3.0 to 5.3.10

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Management Services For Element Software And Netapp Hci	All versions
Netapp Metrocluster Tiebreaker	All versions
Netapp Snap Creator Framework	All versions
Netapp Snapcenter	All versions