CVE-2021-22118 is a high-severity (CVSS 7.8) Improper Privilege Management vulnerability in org.springframework:spring-web. A fix is available for org.springframework:spring-web — see the affected versions and patch details below.
Improper Privilege Management in Spring Framework
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
org.springframework:spring-web☕org.springframework:spring-webReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.springframework:spring-web | ≥ 5.2.0&&< 5.2.15 | 5.2.15org.springframework:spring-web:5.2.15 |
| ☕Maven | org.springframework:spring-web | ≥ 5.3.0&&< 5.3.7 | 5.3.7org.springframework:spring-web:5.3.7 |
Affected Products
hcinetappmanagement services for element softwarenetappcommerce guided searchoraclecommunications brm - elastic charging engineoraclecommunications cloud native core binding support functionoraclecommunications cloud native core policyoracleDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.springframework:spring-web, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.springframework:spring-web to 5.2.15 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-22118 is resolved across your whole dependency graph.
Workarounds
Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
In OpenShift Container Platform (OCP) the jenkins package bundles the vulnerable version of spring-framework, but as Jenkins is not a type of WebFlux application is not impacted by this vulnerability. Therefore the OCP components have been marked as affected/wontfix. This may be fixed in a future release.
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Fuse 7.10 | spring-web | RHSA-2021:5134 |
| Red Hat Integration | see advisory | RHSA-2021:3205 |
| Red Hat Integration | spring-web | RHSA-2021:4918 |
Frequently Asked Questions
Is CVE-2021-22118 in your dependencies?
Find it across Maven, including transitive dependencies.