{"id":"CVE-2024-22259","details":"Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n\nThis is the same as  CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.","aliases":["GHSA-hgjh-9rj2-g67j"],"modified":"2026-04-10T05:09:08.098615Z","published":"2024-03-16T05:15:20.830Z","related":["CGA-m63g-v3f5-mpcw"],"references":[{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20240524-0002/"},{"type":"ADVISORY","url":"https://spring.io/security/cve-2024-22259"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/spring-projects/spring-framework","events":[{"introduced":"0"},{"fixed":"df041ba032cceb9ca5c96214fe238b91c3f94f63"},{"introduced":"5a30a43b753a971ac8bf4005a8ccddeaff439d7e"},{"fixed":"14fa75c98a248751b952622c3f0a8b96a8e0a354"},{"introduced":"e6585e0250519ec6ef85f0ca2f8d9b6151f94397"},{"fixed":"c04290e9ab0b587fe53dec0590aeb45fa55a870e"}],"database_specific":{"versions":[{"introduced":"0"},{"fixed":"5.3.33"},{"introduced":"6.0.0"},{"fixed":"6.0.18"},{"introduced":"6.1.0"},{"fixed":"6.1.5"}]}}],"versions":["v3.2.0.M1","v3.2.0.M2","v3.2.0.RC1","v3.2.0.RC2-A","v3.2.0.RELEASE","v4.0.0.M1","v4.0.0.M2","v4.0.0.M3","v4.0.0.RC1","v4.0.0.RC2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22259.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}]}