Vulnerability in NetApp Active Iq Unified Manager
CVE-2022-22968
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.057 (92.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 93rd percentile — 92.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.057 · newest: 0.057 · change: 0.000
Affected products
- NetApp Active Iq Unified Manager
- NetApp Cloud Secure Agent
- NetApp Metrocluster Tiebreaker
- NetApp Snap Creator Framework
- NetApp Snapmanager
- Oracle MySQL Enterprise Monitor
- VMware Spring Framework
- Spring Framework — versions Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions
Weakness classification (CWE)
Public proof-of-concept exploits
References
- tanzu.vmware.com/security/cve-2022-22968 (Vendor Advisory)
- www.oracle.com/security-alerts/cpujul2022.html (Third Party Advisory)
- security.netapp.com/advisory/ntap-20220602-0004/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-22968?
- CVE-2022-22968 is a medium-severity vulnerability in NetApp Active Iq Unified Manager, classified under Improper Handling of Case Sensitivity. CVSS score: 5.3/10. Published 2022-04-14.
- How severe is CVE-2022-22968?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2022-22968 known to be exploited?
- 36 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.