Server-side request forgery (SSRF) In org.springframework:spring-web
Description
Spring Web vulnerable to Open Redirect or Server Side Request Forgery Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 6.1.4, 6.0.17, 5.3.32 | ||
 debian 13 | - | ||
debian 11 | - | ||
debian 14 | - | ||
debian 12 | - |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4. 5.