CVE-2024-22259: netapp active_iq_unified_manager Open Redirect
Vulnerability summary
CVE-2024-22259 is a high (CVSS 8.1) Open Redirect vulnerability in netapp active_iq_unified_manager. EPSS estimates a 2.57% chance of exploitation in the next 30 days, higher than 84.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 3Timeline
- 16-03-2024PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS trend
Probability
2.57%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.57% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard4 products
- kayenta-2025.4< 2025.4.3-r6
- kayenta-2026.0< 2026.0.2-r6
- kayenta-fips-2025.4< 2025.4.3-r7
- kayenta-fips-2026.0< 2026.0.2-r7
Debian1 product
- libspring-javaAll versions (No fix recorded)
Netapp1 product
Org.springframework1 product
- spring-web≥ 6.1.0, < 6.1.5 | ≥ 6.0.0, < 6.0.18 | < 5.3.33
Spring1 product
- spring framework≥ 6.1.x, < 6.1.5 | ≥ 6.0.x, < 6.0.18 | ≥ 5.3.x, < 5.3.33
Ubuntu1 product
- libspring-javaAll versions (No fix recorded)
Vmware1 product
- spring_framework< 5.3.33 | ≥ 6.0.0, < 6.0.18 | ≥ 6.1.0, < 6.1.5
7 vendors · 10 products
