High severity7.8NVD Advisory· Published May 27, 2021· Updated Jun 17, 2026
CVE-2021-22118
CVE-2021-22118
Description
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.springframework:spring-webMaven | >= 5.2.0, < 5.2.15 | 5.2.15 |
org.springframework:spring-webMaven | >= 5.3.0, < 5.3.7 | 5.3.7 |
Affected products
49- Spring/Spring Frameworkdescription
- cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*Range: >=8.0.0,<=8.1.0
- cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*Range: >=8.2.0,<=8.2.4.0
- cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*Range: >=8.0.0,<=8.2.4.0
- cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*Range: >=8.0.0,<=8.2.4.0
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*Range: >=8.0.8,<=8.1.1
- cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*Range: >=11.0,<=11.3.1
cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_rules_palette:11.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_rules_palette:11.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_rules_palette:11.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_rules_palette:11.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*Range: <=8.0.25
- cpe:2.3:a:oracle:retail_assortment_planning:16.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:*Range: >=16.0,<=19.0
cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_financial_integration:15.0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_integration_bus:16.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
14- www.oracle.com//security-alerts/cpujul2021.htmlnvdPatchThird Party AdvisoryWEB
- www.oracle.com/security-alerts/cpuapr2022.htmlnvdPatchThird Party AdvisoryWEB
- www.oracle.com/security-alerts/cpujan2022.htmlnvdPatchThird Party AdvisoryWEB
- www.oracle.com/security-alerts/cpujul2022.htmlnvdPatchThird Party AdvisoryWEB
- www.oracle.com/security-alerts/cpuoct2021.htmlnvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-gfwj-fwqj-fp3vghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-22118ghsaADVISORY
- security.netapp.com/advisory/ntap-20210713-0005/nvdThird Party Advisory
- tanzu.vmware.com/security/cve-2021-22118nvdThird Party AdvisoryWEB
- github.com/spring-projects/spring-framework/commit/0d0d75e25322d8161002d861fff3ec04ba8be5acghsaWEB
- github.com/spring-projects/spring-framework/commit/cce60c479c22101f24b2b4abebb6d79440b120d1ghsaWEB
- github.com/spring-projects/spring-framework/issues/26931ghsaWEB
- security.netapp.com/advisory/ntap-20210713-0005ghsaWEB
- spring.io/security/cve-2021-22118ghsaWEB
News mentions
0No linked articles in our index yet.