{
  "affected": [
    {
      "database_specific": {
        "unresolved_ranges": [
          {
            "events": [
              {
                "introduced": "8.2.0"
              },
              {
                "last_affected": "8.2.4.0"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "7.4.1"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "20.1.0"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "11.2.0"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "11.3.0"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "8.0.25"
              }
            ]
          }
        ]
      },
      "ranges": [
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "0"
              },
              {
                "fixed": "5.2.9"
              },
              {
                "introduced": "5.3.0"
              },
              {
                "fixed": "5.3.8"
              },
              {
                "introduced": "5.4.0"
              },
              {
                "fixed": "5.4.4"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "6.3"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "6.4"
              }
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "974156d5fb2e05877ca3645b2afa483f1483c9d3"
            },
            {
              "introduced": "747d8817cbadc307f7407c26fc88b2ff63c37149"
            },
            {
              "fixed": "461f1f6b380f263ef0525ab28b188811b3dd7241"
            },
            {
              "introduced": "651c94b3859eb6c3eee4ee632b1419e59d99d8dd"
            },
            {
              "fixed": "abc523c063becc72de115cae9a6fa29d374ab549"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "5d3c0621d1ba97e1b9710005e52e72c31f63349a"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "13816b7978612cf5d6fd0fdbe7a9fe4e3e690af2"
            }
          ],
          "repo": "https://github.com/spring-projects/spring-security",
          "type": "GIT"
        }
      ]
    }
  ],
  "details": "Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.",
  "id": "CVE-2021-22112",
  "modified": "2026-04-01T23:08:01.671640734Z",
  "published": "2021-02-23T19:15:13.573Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r2cb05e499807900ba23e539643eead9c5f0652fd271f223f89da1804%40%3Cpluto-scm.portals.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde%40%3Cpluto-dev.portals.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r413e380088c427f56102968df89ef2f336473e1b56b7d4b3a571a378%40%3Cpluto-dev.portals.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f%40%3Cpluto-dev.portals.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/ra6389b1b82108a3b6bbcd22979f7665fd437c2a3408c9509a15a9ca1%40%3Cpluto-dev.portals.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/redbd004a503b3520ae5746c2ab5e93fd7da807a8c128e60d2002cd9b%40%3Cissues.nifi.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14%40%3Cpluto-dev.portals.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r37423ec7eea340e92a409452c35b649dce02fdc467f0b3f52086c177%40%3Cpluto-dev.portals.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3%40%3Cpluto-dev.portals.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc%40%3Cpluto-scm.portals.apache.org%3E"
    },
    {
      "type": "ADVISORY",
      "url": "https://tanzu.vmware.com/security/cve-2021-22112"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
    },
    {
      "type": "ADVISORY",
      "url": "http://www.openwall.com/lists/oss-security/2021/02/19/7"
    },
    {
      "type": "FIX",
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    },
    {
      "type": "FIX",
      "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}