CVE-2024-22271 - Vulnerability Details - OpenCVE

In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions. Specifically, an application is vulnerable when all of the following are true: User is using Spring Cloud Function Web module Affected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8 References https://spring.io/security/cve-2022-22979 https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/ History 2020-01-16: Initial vulnerability report published.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2024-22271
https://spring.io/security/cve-2024-22271
https://www.cve.org/CVERecord?id=CVE-2024-22271

History

No history.

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2024-07-09T12:50:15.845Z

Updated: 2024-08-01T22:43:34.197Z

Reserved: 2024-01-08T18:43:18.957Z

Link: CVE-2024-22271

Vulnrichment

Updated: 2024-08-01T22:43:34.197Z

NVD

Status : Awaiting Analysis

Published: 2024-07-09T13:15:09.887

Modified: 2024-11-21T08:55:56.137

Link: CVE-2024-22271

Redhat

Severity : Important

Publid Date: 2024-07-09T00:00:00Z

Links: CVE-2024-22271 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22271", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2024-01-08T18:43:18.957Z", "datePublished": "2024-07-09T12:50:15.845Z", "dateUpdated": "2024-08-01T22:43:34.197Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Spring Cloud Function Framework", "vendor": "Spring by VMware Tanzu", "versions": [{"status": "affected", "version": "Spring Cloud Function Framework 4.1.0-4.1.2, Spring Cloud Function Framework 4.0.0-4.0.8"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p>In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions.</p><p>Specifically, an application is vulnerable when all of the following are true:</p><p>User is using Spring Cloud Function Web module</p><p>Affected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8</p><p>References <a target=\"_blank\" rel=\"nofollow\" href=\"https://spring.io/security/cve-2022-22979\">https://spring.io/security/cve-2022-22979</a> <a target=\"_blank\" rel=\"nofollow\" href=\"https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/\">https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/</a> History 2020-01-16: Initial vulnerability report published.</p>\n\n"}], "value": "In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions.\n\nSpecifically, an application is vulnerable when all of the following are true:\n\nUser is using Spring Cloud Function Web module\n\nAffected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8\n\nReferences https://spring.io/security/cve-2022-22979 \u00a0 https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/ \u00a0History 2020-01-16: Initial vulnerability report published."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Web DOS Vulnerability", "lang": "en"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-07-09T12:50:15.845Z"}, "references": [{"url": "https://spring.io/security/cve-2024-22271"}], "source": {"discovery": "UNKNOWN"}, "title": "Spring Cloud Function Web DOS Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation"}]}], "affected": [{"vendor": "vmware", "product": "spring_cloud_function", "cpes": ["cpe:2.3:a:vmware:spring_cloud_function:4.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "4.0.0", "status": "affected", "lessThan": "4.0.8", "versionType": "custom"}]}, {"vendor": "vmware", "product": "spring_cloud_function", "cpes": ["cpe:2.3:a:vmware:spring_cloud_function:4.1.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "4.1.0", "status": "affected", "lessThan": "4.1.2", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-11T20:06:48.215614Z", "id": "CVE-2024-22271", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-12T16:57:54.994Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:34.197Z"}, "title": "CVE Program Container", "references": [{"url": "https://spring.io/security/cve-2024-22271", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://spring.io/security/cve-2024-22271", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:34.197Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22271", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-11T20:06:48.215614Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:vmware:spring_cloud_function:4.0.0:*:*:*:*:*:*:*"], "vendor": "vmware", "product": "spring_cloud_function", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.8", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:vmware:spring_cloud_function:4.1.0:*:*:*:*:*:*:*"], "vendor": "vmware", "product": "spring_cloud_function", "versions": [{"status": "affected", "version": "4.1.0", "lessThan": "4.1.2", "versionType": "custom"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-11T20:10:43.185Z"}}], "cna": {"title": "Spring Cloud Function Web DOS Vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Spring by VMware Tanzu", "product": "Spring Cloud Function Framework", "versions": [{"status": "affected", "version": "Spring Cloud Function Framework 4.1.0-4.1.2, Spring Cloud Function Framework 4.0.0-4.0.8"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://spring.io/security/cve-2024-22271"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions.\n\nSpecifically, an application is vulnerable when all of the following are true:\n\nUser is using Spring Cloud Function Web module\n\nAffected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8\n\nReferences https://spring.io/security/cve-2022-22979 \u00a0 https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/ \u00a0History 2020-01-16: Initial vulnerability report published.", "supportingMedia": [{"type": "text/html", "value": "\n\n<p>In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions.</p><p>Specifically, an application is vulnerable when all of the following are true:</p><p>User is using Spring Cloud Function Web module</p><p>Affected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8</p><p>References <a target=\"_blank\" rel=\"nofollow\" href=\"https://spring.io/security/cve-2022-22979\">https://spring.io/security/cve-2022-22979</a> <a target=\"_blank\" rel=\"nofollow\" href=\"https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/\">https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/</a> History 2020-01-16: Initial vulnerability report published.</p>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Web DOS Vulnerability"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-07-09T12:50:15.845Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22271", "state": "PUBLISHED", "dateUpdated": "2024-08-01T22:43:34.197Z", "dateReserved": "2024-01-08T18:43:18.957Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2024-07-09T12:50:15.845Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions.\n\nSpecifically, an application is vulnerable when all of the following are true:\n\nUser is using Spring Cloud Function Web module\n\nAffected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8\n\nReferences https://spring.io/security/cve-2022-22979 \u00a0 https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/ \u00a0History 2020-01-16: Initial vulnerability report published."}, {"lang": "es", "value": "En el framework Spring Cloud Function, versiones 4.1.x anteriores a 4.1.2, 4.0.x anteriores a 4.0.8, una aplicaci\u00f3n es vulnerable a un ataque de DOS cuando intenta componer funciones con funciones no existentes. Espec\u00edficamente, una aplicaci\u00f3n es vulnerable cuando se cumple todo lo siguiente: El usuario est\u00e1 utilizando el m\u00f3dulo web Spring Cloud Function Productos y versiones de Spring afectados Spring Cloud Function Framework 4.1.0 a 4.1.2 4.0.0 a 4.0.8 Referencias https:// spring.io/security/cve-2022-22979 https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/ Historia 2020-01-16: Informe inicial de vulnerabilidad publicado."}], "id": "CVE-2024-22271", "lastModified": "2024-11-21T08:55:56.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "[email protected]", "type": "Secondary"}]}, "published": "2024-07-09T13:15:09.887", "references": [{"source": "[email protected]", "url": "https://spring.io/security/cve-2024-22271"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://spring.io/security/cve-2024-22271"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "spring-cloud-function-context: Spring Cloud Function Web DOS Vulnerability", "id": "2296608", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2296608"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-400", "details": ["In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions.\nSpecifically, an application is vulnerable when all of the following are true:\nUser is using Spring Cloud Function Web module\nAffected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8\nReferences https://spring.io/security/cve-2022-22979 \u00a0 https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/ \u00a0History 2020-01-16: Initial vulnerability report published.", "A flaw was found in the Spring Cloud Function framework. Affected versions of this package are vulnerable to denial of service (DoS) when attempting to compose functions with nonexisting functions. This flaw allows an attacker to trigger a cache overflow."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-22271", "package_state": [{"cpe": "cpe:/a:redhat:a_mq_clients:2", "fix_state": "Not affected", "package_name": "org.springframework.cloud/spring-cloud-function-context", "product_name": "A-MQ Clients 2"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Not affected", "package_name": "org.springframework.cloud/spring-cloud-function-context", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:7", "fix_state": "Will not fix", "package_name": "org.springframework.cloud/spring-cloud-function-context", "product_name": "Red Hat JBoss Data Grid 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "spring-cloud-function-context", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "spring-cloud-function-context", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "org.springframework.cloud/spring-cloud-function-context", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}], "public_date": "2024-07-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-22271\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-22271\nhttps://spring.io/security/cve-2024-22271"], "statement": "The vulnerability in the Spring Cloud Function framework, which allows an attacker to trigger a cache overflow by attempting to compose functions with nonexisting functions, represents a important severity issue due to its potential to facilitate Denial of Service (DoS) attacks. Such attacks can exploit the cache overflow mechanism to consume excessive computational resources, thereby degrading system performance and rendering the application unavailable to legitimate users.", "threat_severity": "Important"}