CVE-2022-22968: Improper handling of case sensitivity in Spring Framework
Summary
CVE-2022-22968: Improper handling of case sensitivity in Spring Framework. Affects org.springframework:spring-context across 2 version ranges.
< 5.2.21.RELEASE
>= 5.3.0, < 5.3.19
Fixed in 5.2.21.RELEASE or 5.3.19, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2022-22968 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The 'org.springframework:spring-core' package is a core component of the Spring Framework, offering essential functionality and utilities for Spring-based applications. This package is widely used in various Java projects and is a critical dependency for many applications.
Vulnerability Detail
The vulnerability (CVE-2022-22968) in the Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions arises from improper handling of case sensitivity in the patterns for disallowedFields on a DataBinder. This means that a field is not effectively protected unless it is listed with both upper and lower case for the first character, including all nested fields within the property path. Attackers can exploit this vulnerability to bypass field restrictions and potentially manipulate data or perform unauthorized actions. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 7.1.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.2.21.RELEASE5.2.21.RELEASE -
>= 5.3.0, < 5.3.195.3.19
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can manually ensure that all disallowed fields are listed with both upper and lower case for the first character, including nested fields within the property path. This can be done by carefully reviewing and updating the relevant code that uses the DataBinder and disallowedFields functionality.
Conclusion
The vulnerability in the Spring Framework related to improper handling of case sensitivity in disallowedFields patterns can have significant security implications. It is crucial for developers to upgrade to the patched versions of the Spring Framework (5.3.19 and 5.2.21) to mitigate this vulnerability. Additionally, developers should follow secure coding practices and review their code to ensure that all disallowed fields are properly listed. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.springframework:spring-context →
FAQ
This vulnerability allows attackers to bypass field restrictions in the Spring Framework, potentially leading to data manipulation or unauthorized actions.
The vulnerability affects Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions.
There are no known public exploits for this vulnerability at the time of this report.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-context.
