{"action":"Upgrade org.springframework.security:spring-security-web to 5.2.9 (5.2.x), 5.3.8 (5.3.x) or 5.4.4 (5.4.x) or later.","affected":[{"fixed":"5.4.4","introduced":"5.4.0"},{"fixed":"5.3.8","introduced":"5.3.0"},{"fixed":"5.2.9","introduced":"0"}],"component":"org.springframework.security:spring-security-web","cve_ids":["CVE-2021-22112"],"ecosystem":"Maven","epss":0.03286,"exploited":false,"fixed_versions":["5.4.4","5.3.8","5.2.9"],"ghsa_id":"GHSA-gq28-h5vg-8prx","id":"tcs_01M5N8YNK9J28B12NKAW675EMX","modified_at":"2024-03-15T05:19:47.375850Z","published_at":"2021-05-10T15:22:39Z","references":["https://osv.dev/vulnerability/GHSA-gq28-h5vg-8prx","https://nvd.nist.gov/vuln/detail/CVE-2021-22112","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.jenkins.io/security/advisory/2021-02-19","https://tanzu.vmware.com/security/cve-2021-22112","https://lists.apache.org/thread.html/redbd004a503b3520ae5746c2ab5e93fd7da807a8c128e60d2002cd9b@%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/ra6389b1b82108a3b6bbcd22979f7665fd437c2a3408c9509a15a9ca1@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc@%3Cpluto-scm.portals.apache.org%3E","https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r413e380088c427f56102968df89ef2f336473e1b56b7d4b3a571a378@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r37423ec7eea340e92a409452c35b649dce02fdc467f0b3f52086c177@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r2cb05e499807900ba23e539643eead9c5f0652fd271f223f89da1804@%3Cpluto-scm.portals.apache.org%3E","https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14@%3Cpluto-dev.portals.apache.org%3E","https://github.com/spring-projects/spring-security/releases/tag/5.4.4","https://github.com/spring-projects/spring-security","http://www.openwall.com/lists/oss-security/2021/02/19/7"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-gq28-h5vg-8prx#Maven/org.springframework.security:spring-security-web","url":"https://osv.dev/vulnerability/GHSA-gq28-h5vg-8prx"}],"summary":"Privilege escalation in spring security"}