CVE-2024-22262

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2024-22262 affects applications built with Spring Framework that use UriComponentsBuilder to parse externally supplied URLs, such as those received through query parameters, while also performing host-based validation checks on the resulting URI. The flaw stems from inconsistent parsing behavior that can allow specially crafted inputs to bypass those checks, exposing the application to open redirect or server-side request forgery outcomes when the validated URL is subsequently used. The issue is functionally equivalent to the earlier CVE-2024-22259 and CVE-2024-22243 disclosures but is triggered by different input patterns.

An unauthenticated remote attacker can supply a malicious URL via user-controlled input. If the application trusts the host validation performed on the parsed object, the attacker may cause an open redirect to an arbitrary destination or induce the server to issue requests to internal resources that would otherwise be blocked.

Spring has published an advisory at https://spring.io/security/cve-2024-22262 that details the affected versions and required updates; NetApp has issued a corresponding advisory (NTAP-20240524-0003) for its products that incorporate the vulnerable component.

The EPSS score reached a peak of 0.1520 after disclosure, indicating a measurable increase in observed exploitation interest relative to its initial low baseline.