CVE-2022-22968: 
Java vulnerability analysis and mitigation

The Spring Framework vulnerability (CVE-2022-22968) affects versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions. The vulnerability relates to the patterns for disallowedFields on a DataBinder being case sensitive, which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including all nested fields within the property path (Spring Security, NVD).

The vulnerability is related to data binding used to populate an object from request parameters (either query parameters or form data). The issue specifically affects applications using spring-webmvc or spring-webflux dependency where data binding is used for controller method parameters annotated with @ModelAttribute or without any Spring Web annotation. The vulnerability does not affect @RequestBody controller method parameters. The CVSS v3.1 base score is 5.3 (MEDIUM) with the vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (Spring Blog, NVD).

When successfully exploited, this vulnerability could lead to addition or modification of data through improperly protected fields in data binding operations. The vulnerability affects the integrity of data but does not impact confidentiality or availability (Spring Security).

The vulnerability was discovered internally by the Spring Framework team as a follow-up to CVE-2022-22965. The vulnerability requires network access and can be exploited without authentication or user interaction (Spring Security).

Users of affected versions should upgrade to Spring Framework 5.3.19+ for 5.3.x users or 5.2.21+ for 5.2.x users. Additionally, applications should review their DataBinder configuration and their approach to data binding. As an alternative to using disallowed field patterns, it is recommended to use a dedicated model object that exposes only properties relevant for the supported use case, or switch to allowed field patterns using setAllowedFields() in WebDataBinder (Spring Blog).