{"uuid": "4f27bc69-6df3-4cdb-b58c-6ed840172b7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-22243", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/4312", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-22259\n\ud83d\udd25 CVSS Score: 8.0 (CVSS_V3)\n\ud83d\udd39 Description: Applications that use UriComponentsBuilder in Spring Framework\u00a0to parse an externally provided URL (e.g. through a query parameter) AND\u00a0perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html \u00a0attack or to a SSRF attack if the URL is used after passing validation checks.\n\nThis is the same as  CVE-2024-22243 https://spring.io/security/cve-2024-22243, but with different input.\n\ud83d\udccf Published: 2024-03-16T06:30:27Z\n\ud83d\udccf Modified: 2025-02-13T19:05:43Z\n\ud83d\udd17 References:\n1. https://nvd.nist.gov/vuln/detail/CVE-2024-22259\n2. https://github.com/spring-projects/spring-framework/commit/297cbae2990e1413537c55845a7e0ea0ffd9f9bb\n3. https://github.com/spring-projects/spring-framework/commit/381f790329a48b74c2a49fc1384dd68ca9153501\n4. https://github.com/spring-projects/spring-framework/commit/f2fd2f12269c6a781c5b2c20b3c24141055a3d68\n5. https://github.com/spring-projects/spring-framework\n6. https://security.netapp.com/advisory/ntap-20240524-0002\n7. https://spring.io/security/cve-2024-22259", "creation_timestamp": "2025-02-13T19:16:31.000000Z"}