Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-22259 is a high-severity Open Redirect (CWE-601) vulnerability in Vmware Spring Framework. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 15% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-22259 affects the UriComponentsBuilder component in Spring Framework. Applications that accept an externally supplied URL, such as via a query parameter, parse it with UriComponentsBuilder, and then perform host-based validation checks on the result can be tricked into treating a malicious URL as valid. The issue is functionally equivalent to CVE-2024-22243 but is triggered by different input patterns, and carries a CVSS 3.1 score of 8.1.
An unauthenticated remote attacker can supply a crafted URL that bypasses the host validation logic. Successful exploitation may result in an open redirect that sends users to an attacker-controlled site or, when the parsed URL is subsequently used for outbound requests, a server-side request forgery that reaches internal resources.
Spring has published mitigation guidance at https://spring.io/security/cve-2024-22259, and NetApp has issued a corresponding advisory at https://security.netapp.com/advisory/ntap-20240524-0002/. The associated EPSS score has remained near 0.56 with only minimal movement between its recorded peak and current values.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0937
Vulnerability Data
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to…
more
a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.7.2
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly checks and rejects untrusted redirect targets before they are used in a response.
Information flow enforcement can restrict redirects to only approved/trusted destinations, stopping untrusted user-supplied URLs from being followed.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and untrusted-redirect controls that prevent CWE-601.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.