What’s Vulnerable › Vulnerabilities

CVE-2024-22236

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-31 · updated 2026-06-17
• Weakness: CWE-732

Description

In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in the org.springframework.cloud:spring-cloud-contract-shade dependency.

Affected products

• Spring Cloud Contract: from 3.1.0 before 3.1.10; from 4.0.0 before 4.0.5; 4.1.0 — fixed in 3.1.10, 4.0.5
• Spring Cloud Contract: from 4.1.0 before 4.1.1; from 4.0.0 before 4.0.6; from 3.1.0 before 3.1.10 — fixed in 4.1.1, 4.0.6, 3.1.10

How to fix

Upgrade to a fixed version: Spring Cloud Contract 3.1.10, 4.0.5; Spring Cloud Contract 4.1.1, 4.0.6, 3.1.10. Check the vendor advisory for mitigations.

References

• https://spring.io/security/cve-2024-22236
• https://spring.io/security/cve-2024-22236

Get alerted when CVE-2024-22236 or the next vulnerability affects your stack