CVE-2024-22236
Low
Description
In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in the org.springframework.cloud:spring-cloud-contract-shade dependency.
SeverityLow
CVSS3.3
Exploit probability—
Product
Vmware Spring Cloud Contract
PublishedJan 31, 2024
First seenJan 31, 2024
Weakness typeCWE-377CWE-377
How to fix
Update
- vmware spring_cloud_contract3.1.10, 4.0.5 or later
- org.springframework.cloud:spring-cloud-contract-shade4.1.1, 4.0.5, 3.1.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vmware spring_cloud_contract | 3.1.0 ≤ v < 3.1.10, 4.0.0 ≤ v < 4.0.5, 4.1.0 | 3.1.10, 4.0.5 |
| org.springframework.cloud:spring-cloud-contract-shadeMaven | 4.1.0 ≤ v < 4.1.1, 4.0.0 ≤ v < 4.0.5, 3.1.0 ≤ v < 3.1.10 | 4.1.1, 4.0.5, 3.1.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.