What it is about

Das Spring Framework bietet ein Entwicklungsmodell für Java mit Infrastrukturunterstützung auf Anwendungsebene. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Framework ausnutzen, um Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.

Under what conditions?

Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.

What can happen in the worst case

An attacker could use the vulnerability to

• Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen

Am I affected?

Affected according to the BSI:

• IBM InfoSphere Information Server 11.7
• IBM Operational Decision Manager
• NetApp ActiveIQ Unified Manager
• IBM Business Automation Workflow
• Red Hat Integration Camel for Spring Boot 1
• IBM InfoSphere Information Server
• VMware Tanzu Spring Framework <5.3.41
• VMware Tanzu Spring Framework <6.0.25
• VMware Tanzu Spring Framework <6.1.14
• Hitachi Ops Center
• RealObjects PDFreactor <12.0.1
• Atlassian Confluence <8.5.18

and 17 more

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• VMware Tanzu Spring Framework 5.3.41
• VMware Tanzu Spring Framework 6.0.25
• VMware Tanzu Spring Framework 6.1.14
• RealObjects PDFreactor 12.0.1
• Atlassian Confluence 8.5.18
• Atlassian Confluence 7.19.30
• Atlassian Bitbucket Data Center 9.5.0
• Atlassian Bitbucket Data Center 9.4.2 (LTS)
• Atlassian Bitbucket Data Center 8.9.24 (LTS)
• Atlassian Confluence 9.2.0 (LTS)
• Atlassian Confluence 8.5.18 (LTS)
• Atlassian Confluence 7.19.30 (LTS)

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.