CVE-2022-22976: netapp active_iq_unified_manager Integer Overflow or Wraparound
Vulnerability summary
CVE-2022-22976 is a medium (CVSS 5.3) Integer Overflow or Wraparound vulnerability in netapp active_iq_unified_manager. EPSS estimates a 2.34% chance of exploitation in the next 30 days, higher than 83.6% of scored vulnerabilities.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 19-05-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
2.34%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.34% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Netapp1 product
Oracle1 product
- financial_services_crime_and_compliance_management_studio8.0.8.2.0 | 8.0.8.3.0
Org.springframework.security1 product
- spring-security-core≥ 5.2.0.RELEASE, < 5.5.7 | ≥ 5.6.0, < 5.6.4
Ubuntu1 product
- libspring-javaAll versions (No fix recorded)
Vmware1 product
- spring_security≥ 5.2.1, < 5.5.7 | ≥ 5.6.0, < 5.6.4 | 5.2.0
5 vendors · 5 products
