CVE-2021-22112

pivotal software spring security, vmware spring security, oracle communications element manager +5 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-22112

Katalog CVE

CVSS 8.8 · High EPSS 3,3%

Kerentanan pada pivotal software spring security, vmware spring security +6 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.

Rincian

Terbit di NVD
23 Februari 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
EPSS (30 hari)
3,3% peluang dieksploitasi; lebih tinggi dari 88,1% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
pivotal software spring security Semua versi sebelum 5.2.9
pivotal software spring security Versi 5.3.0 hingga sebelum 5.3.8
vmware spring security Versi 5.4.0 hingga sebelum 5.4.4
oracle communications element manager Versi 8.2.0 hingga 8.2.4.0
oracle communications interactive session recorder Versi 6.3
oracle communications interactive session recorder Versi 6.4
oracle communications unified inventory management Versi 7.4.1
oracle hospitality cruise shipboard property management system Versi 20.1.0
oracle insurance policy administration Versi 11.2.0
oracle insurance policy administration Versi 11.3.0
oracle mysql enterprise monitor Semua versi hingga 8.0.25

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.