What is CVE-2024-22243?

CVE-2024-22243 is a security vulnerability affecting applications that use UriComponentsBuilder to parse externally provided URLs and perform validation checks on the host. While the severity is not explicitly mentioned, this vulnerability can potentially lead to open redirect attacks or Server-Side Request Forgery (SSRF) attacks. The types of systems affected are not specified, but any application meeting the mentioned criteria could be at risk.

Who is impacted by CVE-2024-22243?

If you're using Spring Framework versions 6.1.0 - 6.1.3, 6.0.0 - 6.0.16, or 5.3.0 - 5.3.31, your application might be at risk. Older, unsupported versions are also affected. It's important to be aware of this issue and take necessary precautions to protect your application.

What should I do if I’m affected?

If you're affected by the CVE-2024-22243 vulnerability, it's crucial to take action to protect your application. Check your Spring Framework version to see if it's affected. Upgrade to a secure version of the Spring Framework as recommended by the Spring website. No additional steps are necessary after upgrading.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2024-22243 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog.

Weakness Enumeration

The weakness enumeration for this vulnerability is "Insufficient Information," indicating a lack of specific details about the vulnerability and its mitigation.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the resources listed below.

• Spring Framework URL Parsing with Host Validation

• CVE Record | CVE