CVE-2021-22118 @ Maven-org.springframework:spring-web-5.3.4

[AASMACMX]

Vulnerable Package issue exists @ Maven-org.springframework:spring-web-5.3.4 in branch main

In Spring Framework, versions 5.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.

Namespace: CxDemoInABoxRepos
Repository: Java-Webgoat
Repository Url: https://github.com/CxDemoInABoxRepos/Java-Webgoat
CxAST-Project: CxDemoInABoxRepos/Java-Webgoat
CxAST platform scan: 466e73ae-3cc9-415a-8383-b7e20e1af3be
Branch: main
Application: Java-Webgoat
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
CWE: CWE-269

---

Additional Info
Attack vector: LOCAL
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH
Remediation Upgrade Recommendation: 5.3.7

---

References
Advisory
Advisory
Issue
Commit
Commit