CVE-2021-22112

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-23 · updated 2026-06-17

Description

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.

Affected products

Oracle Communications Element Manager: from 8.2.0 through 8.2.4.0
Oracle Corporation Communications Interactive Session Recorder: 6.3, 6.4
Oracle Corporation Oracle Communications Unified Inventory Management: 7.4.1
Oracle Corporation Hospitality Cruise Shipboard Property Management System: 20.1.0
Oracle Insurance Policy Administration: 11.2.0, 11.3.0
Oracle Corporation MySQL Enterprise Monitor: through 8.0.25
Spring by VMware Spring Security: before 5.2.9; from 5.3.0 before 5.3.8 — fixed in 5.2.9, 5.3.8
Spring Security: from 5.4.0 before 5.4.4 — fixed in 5.4.4
Spring Security: from 5.4.x prior through 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE

How to fix

Upgrade to a fixed version: Spring by VMware Spring Security 5.2.9, 5.3.8; Spring Security 5.4.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-22112 or the next vulnerability affects your stack