Vulnerability in Netapp Active Iq Unified Manager
CVE-2022-22968
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
EPSS: 0.057 (92.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Netapp Active_iq_unified_manager
- Netapp Cloud_secure_agent
- Netapp Metrocluster_tiebreaker
- Netapp Snap_creator_framework
- Netapp Snapmanager
- Oracle Mysql_enterprise_monitor
- Vmware Spring_framework
- N/a Spring Framework — versions Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@vmware.com (x_refsource_MISC, Vendor Advisory)
- security@vmware.com (Third Party Advisory, x_refsource_MISC)
- security@vmware.com (x_refsource_CONFIRM, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-22968?
- CVE-2022-22968 is a medium-severity vulnerability in Netapp Active Iq Unified Manager, classified under Improper Handling of Case Sensitivity. CVSS score: 5.3/10. Published 2022-04-14.
- How severe is CVE-2022-22968?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2022-22968 known to be exploited?
- 36 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.