CVE-2024-22236

State: Published
Severity: 3.3 Low
Published: Jan 31, 2024
Updated: Jun 3, 2025
Reserved: Jan 8, 2024

Description

In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in the org.springframework.cloud:spring-cloud-contract-shade dependency.

Scores

CVSS	Score	Vector	Source
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	vmware

Weaknesses

CWE-377 Insecure Temporary File

Affected Products

Product	Versions
Spring Cloud ContractSpring	4.1.0 to before 4.1.1Affected 4.0.0 to before 4.0.6Affected 3.1.0 to before 3.1.10Affected

References

https://spring.io/security/cve-2024-22236

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.