What it is about

Das Spring Framework bietet ein Entwicklungsmodell für Java mit Infrastrukturunterstützung auf Anwendungsebene. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Framework ausnutzen, um Dateien zu manipulieren oder Informationen offenzulegen.

Under what conditions?

Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.

What can happen in the worst case

An attacker could use the vulnerability to

• Dateien zu manipulieren oder Informationen offenzulegen

Am I affected?

Affected according to the BSI:

• Hitachi Ops Center
• VMware Tanzu Spring Framework <6.1.5
• VMware Tanzu Spring Framework <6.0.18
• VMware Tanzu Spring Framework <5.3.33
• Shibboleth Identity Provider <5.1.1
• Shibboleth Identity Provider <4.3.2
• Atlassian Bamboo <9.6.1 (LTS)
• Atlassian Bamboo <9.5.3
• Atlassian Bamboo <9.2.13 (LTS)
• Atlassian Confluence Data Center <8.9.3
• Atlassian Confluence <8.5.11 LTS
• Atlassian Confluence <7.19.24 LTS

and 6 more

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• VMware Tanzu Spring Framework 6.1.5
• VMware Tanzu Spring Framework 6.0.18
• VMware Tanzu Spring Framework 5.3.33
• Shibboleth Identity Provider 5.1.1
• Shibboleth Identity Provider 4.3.2
• Atlassian Bamboo 9.6.1 (LTS)
• Atlassian Bamboo 9.5.3
• Atlassian Bamboo 9.2.13 (LTS)
• Atlassian Confluence Data Center 8.9.3
• Atlassian Confluence 8.5.11 LTS
• Atlassian Confluence 7.19.24 LTS
• HCL Commerce 9.1.17.0

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.