org.springframework:spring (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.springframework:spring, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (3)

• CVE-2023-20860 — CVSS 7.5 (high): Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the…
• CVE-2010-1622 — CVSS 6.0 (medium): SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute…
• CVE-2021-22096 — CVSS 4.3 (medium): In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious…