Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NSummary
CVE-2024-22262 is a high-severity Open Redirect (CWE-601) vulnerability in Spring (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-22262 affects applications built with Spring Framework that use UriComponentsBuilder to parse externally supplied URLs, such as those received through query parameters, while also performing host-based validation checks on the resulting URI. The flaw stems from inconsistent parsing behavior that can allow specially crafted inputs to bypass those checks, exposing the application to open redirect or server-side request forgery outcomes when the validated URL is subsequently used. The issue is functionally equivalent to the earlier CVE-2024-22259 and CVE-2024-22243 disclosures but is triggered by different input patterns.
An unauthenticated remote attacker can supply a malicious URL via user-controlled input. If the application trusts the host validation performed on the parsed object, the attacker may cause an open redirect to an arbitrary destination or induce the server to issue requests to internal resources that would otherwise be blocked.
Spring has published an advisory at https://spring.io/security/cve-2024-22262 that details the affected versions and required updates; NetApp has issued a corresponding advisory (NTAP-20240524-0003) for its products that incorporate the vulnerable component.
The EPSS score reached a peak of 0.1520 after disclosure, indicating a measurable increase in observed exploitation interest relative to its initial low baseline.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1071
Vulnerability Data
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack…
more
if the URL is used after passing validation checks. This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.7.2V1.3.6V1.5.3V5.3.2
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement can restrict which destinations the server is allowed to contact on behalf of users.
Input validation directly checks and rejects untrusted redirect targets before they are used in a response.
Boundary protection limits the network reach of server-initiated requests even if SSRF occurs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and untrusted-redirect controls that prevent CWE-601.
Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.
Vulnerability identification processes can discover and record SSRF flaws in web applications.
Network segmentation and egress controls can limit the damage from successful SSRF requests.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Operational threat data describing SSRF campaigns can be used to tighten outbound-request allow-lists and detection rules before attackers exploit them.
Preventing access to attacker-controlled or malicious sites stops users from being redirected to untrusted locations via open-redirect or phishing links.