CVE-2021-22112
high
CVSS v3
—
CVSS v4 NEW
—
VIR risk
8.0
Description
Privilege escalation in spring security
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
OS impact
Arch Fixed 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Fixed | 2.280-1 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-bom | >=5.4.0,<5.4.4 | 5.4.4 |
| Maven | org.springframework.security:spring-security-bom | >=5.3.0,<5.3.8 | 5.3.8 |
| Maven | org.springframework.security:spring-security-bom | <5.2.9 | 5.2.9 |
| Maven | org.springframework.security:spring-security-web | >=5.4.0,<5.4.4 | 5.4.4 |
| Maven | org.springframework.security:spring-security-web | >=5.3.0,<5.3.8 | 5.3.8 |
| Maven | org.springframework.security:spring-security-web | <5.2.9 | 5.2.9 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-22112
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.jenkins.io/security/advisory/2021-02-19
- https://tanzu.vmware.com/security/cve-2021-22112
- https://lists.apache.org/thread.html/redbd004a503b3520ae5746c2ab5e93fd7da807a8c128e60d2002cd9b@%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/ra6389b1b82108a3b6bbcd22979f7665fd437c2a3408c9509a15a9ca1@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc@%3Cpluto-scm.portals.apache.org%3E
- https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r413e380088c427f56102968df89ef2f336473e1b56b7d4b3a571a378@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r37423ec7eea340e92a409452c35b649dce02fdc467f0b3f52086c177@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r2cb05e499807900ba23e539643eead9c5f0652fd271f223f89da1804@%3Cpluto-scm.portals.apache.org%3E
- https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14@%3Cpluto-dev.portals.apache.org%3E
- https://github.com/spring-projects/spring-security/releases/tag/5.4.4
- https://github.com/spring-projects/spring-security
- http://www.openwall.com/lists/oss-security/2021/02/19/7
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.