CVE
CVE-2010-1622
- First Reported
- Apr 1, 2022
- Latest Reported
- Apr 1, 2022
CVE Enrichment
- CVSS
- 6.0 MEDIUM
- EPSS
- 52.00%
- EPSS Percentile
- 98.95%
- CISA KEV
- Not listed
Description
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.
Technical Details
- CVSS Version
- 2.0
- CNA / NVD Source
- secalert@redhat.com
- Published
- 21-Jun-2010 23:30
- Last Modified
- 17-Jun-2026 06:18
- EPSS Date
- 2026-10-19
- CWE
- CWE-94
CVSS Vector
AV:N /
AC:M /
Au:S /
C:P /
I:P /
A:P
Affected Products / Versions
- oracle / fusion_middleware
Version / affected range: 7.6.2
cpe:2.3:a:oracle:fusion_middleware:7.6.2:*:*:*:*:*:*:* - oracle / fusion_middleware
Version / affected range: 11.1.1.6.1
cpe:2.3:a:oracle:fusion_middleware:11.1.1.6.1:*:*:*:*:*:*:* - oracle / fusion_middleware
Version / affected range: 11.1.1.8.0
cpe:2.3:a:oracle:fusion_middleware:11.1.1.8.0:*:*:*:*:*:*:* - springsource / spring_framework
Version / affected range: 2.5.0
cpe:2.3:a:springsource:spring_framework:2.5.0:*:*:*:*:*:*:* - springsource / spring_framework
Version / affected range: 2.5.1
cpe:2.3:a:springsource:spring_framework:2.5.1:*:*:*:*:*:*:* - springsource / spring_framework
Version / affected range: 2.5.2
cpe:2.3:a:springsource:spring_framework:2.5.2:*:*:*:*:*:*:* - springsource / spring_framework
Version / affected range: 2.5.3
cpe:2.3:a:springsource:spring_framework:2.5.3:*:*:*:*:*:*:* - springsource / spring_framework
Version / affected range: 2.5.4
cpe:2.3:a:springsource:spring_framework:2.5.4:*:*:*:*:*:*:* - springsource / spring_framework
Version / affected range: 2.5.5
cpe:2.3:a:springsource:spring_framework:2.5.5:*:*:*:*:*:*:* - springsource / spring_framework
Version / affected range: 2.5.6
cpe:2.3:a:springsource:spring_framework:2.5.6:*:*:*:*:*:*:* - springsource / spring_framework
Version / affected range: 2.5.7
cpe:2.3:a:springsource:spring_framework:2.5.7:*:*:*:*:*:*:* - springsource / spring_framework
Version / affected range: 3.0.0
cpe:2.3:a:springsource:spring_framework:3.0.0:*:*:*:*:*:*:* - springsource / spring_framework
Version / affected range: 3.0.1
cpe:2.3:a:springsource:spring_framework:3.0.1:*:*:*:*:*:*:* - springsource / spring_framework
Version / affected range: 3.0.2
cpe:2.3:a:springsource:spring_framework:3.0.2:*:*:*:*:*:*:*
References
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- Praetorian have claimed that this vulnerability is in fact a bypass of a much older vulnerability in Spring Framework (CVE-2010-1622). Spring4Shell and CVE-2022-22963: Affected Versions, Exploitation Conditions and Fixes
CVE (2)
Vendors (3)
Products (6)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.