Vulnerability in Spring Cloud Contract
CVE-2024-22236
In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in the org.springframework.cloud:spring-cloud-contract-shade dependency.
EPSS: 0.002 (13.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Spring Cloud Contract — versions 4.1.0, 4.0.0, 3.1.0
- Vmware Spring_cloud_contract — versions 4.1.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@vmware.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-22236?
- CVE-2024-22236 is a low-severity vulnerability in Spring Cloud Contract, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 3.3/10. Published 2024-01-31.
- How severe is CVE-2024-22236?
- Low severity. CVSS v3 base score is 3.3 out of 10.
- Is CVE-2024-22236 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.