Descripción
A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
CVSS 3.7EPSS 0.17700000000000002%Riesgo 0.38
Ver fuente- Publicación
- 2026-06-09 05:16:37
- Versiones afectadas
- <=7.0.7,<=6.2.18,<=6.1.27,<=5.3.48
- Tipo
- Package
- Última modificación
- 2026-07-23 08:10:00
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L