CVE-2025-22235

Katalog CVE

CVSS 7.3 · High EPSS 0,43%

Kerentanan Improper Input Validation. Skor CVSS 3.1 7.3 (High) menurut vmware.com.

Deskripsi (NVD)

EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: * You use Spring Security * EndpointRequest.to() has been used in a Spring Security chain configuration * The endpoint which EndpointRequest references is disabled or not exposed via web * Your application handles requests to /null and this path needs protection You are not affected if any of the following is true: * You don't use Spring Security * You don't use EndpointRequest.to() * The endpoint which EndpointRequest.to() refers to is enabled and is exposed * Your application does not handle requests to /null or this path does not need protection

Rincian

Terbit di NVD

28 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

7.3 (High), sumber vmware.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://spring.io/security/cve-2025-22235
• https://security.netapp.com/advisory/ntap-20250516-0010/