CVE-2021-22113

Description

Applications using the Sensitive Headers functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the Sensitive Headers restriction when executing requests with specially constructed URLs. Applications that use Spring Securitys StrictHttpFirewall (enabled by default for all URLs) are not affected by the vulnerability, as they reject requests that allow bypassing.

Risk Information

Base Score

5.3

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Score

Exploitation Probability

0.149

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-22113 are fixed in Spring-cloud-netflix-zuul 2.2.7	Windows
Vulnerabilities CVE-2021-22113 are fixed in Spring-cloud-netflix-zuul for Linux 2.2.7	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234