← Back

CVE-2022-22971

nvd nist
Published: May 12, 2022Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

Affected (6)

Vmware
1 product
Spring Framework
Oracle
1 product
Financial Services Crime And Compliance Management Studio
Netapp
2 products
Cloud Secure Agent
Oncommand Insight
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Framework
From 5.2.0 to 5.2.21
Spring Framework
From 5.3.0 to 5.3.19
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Oracle
Financial Services Crime And Compliance Management Studio
Version 8.0.8.2.0
Financial Services Crime And Compliance Management Studio
Version 8.0.8.3.0
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Cloud Secure Agent
All versions
Oncommand Insight
All versions

Related CWEs

CWE-770
Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (6)

Source: security@vmware.com
Third Party Advisory
Source: security@vmware.com
MitigationVendor Advisory
Source: security@vmware.com
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.