CVE-2021-22051GHSA-2R2V-Q399-QQ93
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream servi
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.0.5, 2.2.10.RELEASE0.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a Spring Cloud Gateway
Version range not reported
- org.springframework.cloud:spring-cloud-gatewayMaven
From 3.0.0 · fixed in 3.0.5
- org.springframework.cloud:spring-cloud-gatewayMaven
From 2.2.0 · fixed in 2.2.10.RELEASE0.5