BlackTreeCVE IntelligenceSpring · Spring Framework
Medium technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.
Debian, ubuntu findings are scoped to the named distribution, release and source package. An absent finding does not mean a package is unaffected.
A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.
| Distribution release | Source package | Vendor state | Fixed version | Evidence |
|---|---|---|---|---|
| Debian trixietrixie · source | libspring-java | Not affectedDebian marks this release not affected (fixed-version marker 0). | Not published in this feed | Debian Security Tracker ↗Source updated 24 Oct 2026 |
| Debian bookwormbookworm · source | libspring-java | Not affectedDebian marks this release not affected (fixed-version marker 0). | Not published in this feed | Debian Security Tracker ↗Source updated 24 Oct 2026 |
| Debian forkyforky · source | libspring-java | Not affectedDebian marks this release not affected (fixed-version marker 0). | Not published in this feed | Debian Security Tracker ↗Source updated 24 Oct 2026 |
| Debian sidsid · source | libspring-java | Not affectedDebian marks this release not affected (fixed-version marker 0). | Not published in this feed | Debian Security Tracker ↗Source updated 24 Oct 2026 |
| Ubuntu 24.04 LTSnoble · esm-apps | libspring-java | Under evaluationCanonical reports that the package might be affected and still needs evaluation or fixing. | Not published in this feed | Canonical Ubuntu Security ↗Source updated 23 Oct 2026 |
These OSV and GitHub advisory ranges apply only to the named package and ecosystem. A listed fixed version is not a universal product patch or proof that an update is installed.
| Ecosystem and package | Affected range | First fixed version | Evidence |
|---|---|---|---|
| mavenorg.springframework:spring-webflux | >= 5.2.0, < 5.2.3 | 5.2.3 | GitHub advisory ↗github reviewed aggregator · 25 Mar 2024 |
| mavenorg.springframework:spring-webmvc | >= 5.2.0, < 5.2.3 | 5.2.3 | GitHub advisory ↗github reviewed aggregator · 25 Mar 2024 |
Medium technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.
Patch availableSpring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.
The application accepts a state-changing browser request without a reliable anti-forgery check.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.
The application accepts a state-changing browser request without a reliable anti-forgery check.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.
A structured CVE source labels at least one public reference as exploit material. BlackTree has not independently validated that it is safe, reliable or weaponised.
CWE-352: Cross-Site Request Forgery (CSRF). The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 17 Jan 2020 · Last source change 17 Sept 2024, 01:45 UTC · CWE-352 · Cross-Site Request Forgery (CSRF)
Core structured fields are present and their contributing authorities are shown above.
No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.