CVE-2022-22968: netapp active_iq_unified_manager Improper Handling of Case Sensitivity
Vulnerability summary
CVE-2022-22968 is a medium (CVSS 5.3) Improper Handling of Case Sensitivity vulnerability in netapp active_iq_unified_manager. EPSS estimates a 5.67% chance of exploitation in the next 30 days, higher than 92.8% of scored vulnerabilities.
Timeline
- 14-04-2022PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NDiffers
EPSS trend
Probability
5.67%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 5.67% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Netapp5 products
Debian1 product
- libspring-javaAll versions (No fix recorded)
Oracle1 product
- mysql_enterprise_monitor≤ 8.0.29
Org.springframework1 product
- spring-context≥ 5.3.0, < 5.3.19 | < 5.2.21.RELEASE
Ubuntu1 product
- libspring-javaAll versions (No fix recorded)
Vmware1 product
- spring_framework< 5.2.0 | ≥ 5.2.0, ≤ 5.2.20 | ≥ 5.3.0, ≤ 5.3.18
6 vendors · 10 products
