Expression Language Injection Affecting org.springframework:spring-web package, versions [,2.5.6.SEC03) [3.0.0.RELEASE,3.0.6.RELEASE)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGSPRINGFRAMEWORK-31329
- published 9 Sep 2011
- disclosed 9 Sep 2011
- credit Stefano Di Paola, Arshan Dabirsiaghi
How to fix?
Upgrade org.springframework:spring-web to version 2.5.6.SEC03, 3.0.6.RELEASE or higher.
Overview
org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.
Affected versions of this package are vulnerable to Expression Language Injection. When a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."