MEDIUM 4.2
GHSA-7m2p-62gw-p8qq
Spring Framework Server-Side Request Forgery via UriComponentsBuilder
Quick fix
GHSA-7m2p-62gw-p8qq — org.springframework:spring-web: upgrade to the fixed version with the command below.
# pom.xml: bump <version>7.0.8</version> for org.springframework:spring-webDetails
Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.
Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven / org.springframework:spring-web
Introduced in:
7.0.0 Fixed in: 7.0.8 Fix
# pom.xml: bump <version>7.0.8</version> for org.springframework:spring-web Maven / org.springframework:spring-web
Introduced in:
6.2.0 Fixed in: 6.2.19 Fix
# pom.xml: bump <version>6.2.19</version> for org.springframework:spring-web