Refine your search

3 vulnerabilities found for Cloud Gateway Server by Spring

CERTFR-2025-AVI-0883
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Spring. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Spring Spring Framework Spring Framework versions 5.3.x antérieures à 5.3.46
Spring Cloud Gateway Server Cloud Gateway versions 4.3.x antérieures à 4.3.2
Spring Cloud Gateway Server Cloud Gateway versions antérieures à 3.1.12
Spring Cloud Gateway Server Cloud Gateway versions 4.1.x antérieures à 4.1.12
Spring Spring Framework Spring Framework versions 6.x antérieures à 6.1.24
Spring Spring Framework Spring Framework versions 6.2.x antérieures à 6.2.12
Spring Cloud Gateway Server Cloud Gateway versions 4.0.x antérieures à 4.1.12
Spring Cloud Gateway Server Cloud Gateway versions 4.2.x antérieures à 4.2.6
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Spring Framework versions 5.3.x ant\u00e9rieures \u00e0 5.3.46",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Gateway versions 4.3.x ant\u00e9rieures \u00e0 4.3.2",
      "product": {
        "name": "Cloud Gateway Server",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Gateway versions ant\u00e9rieures \u00e0 3.1.12",
      "product": {
        "name": "Cloud Gateway Server",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Gateway versions 4.1.x ant\u00e9rieures \u00e0 4.1.12",
      "product": {
        "name": "Cloud Gateway Server",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Spring Framework versions 6.x ant\u00e9rieures \u00e0 6.1.24",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Spring Framework versions 6.2.x ant\u00e9rieures \u00e0 6.2.12",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Gateway versions 4.0.x ant\u00e9rieures \u00e0 4.1.12",
      "product": {
        "name": "Cloud Gateway Server",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Gateway versions 4.2.x ant\u00e9rieures \u00e0 4.2.6",
      "product": {
        "name": "Cloud Gateway Server",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-41253",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41253"
    },
    {
      "name": "CVE-2025-41254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41254"
    }
  ],
  "initial_release_date": "2025-10-16T00:00:00",
  "last_revision_date": "2025-10-16T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0883",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-10-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Spring. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Spring",
  "vendor_advisories": [
    {
      "published_at": "2025-10-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2025-41254",
      "url": "https://spring.io/security/cve-2025-41254"
    },
    {
      "published_at": "2025-10-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2025-41253",
      "url": "https://spring.io/security/cve-2025-41253"
    }
  ]
}

CERTFR-2025-AVI-0763
Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans Spring Cloud Gateway. Elle permet à un attaquant de provoquer une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Spring Cloud Gateway Server Cloud Gateway versions 4.3.x antérieures à 4.3.1
Spring Cloud Gateway Server Cloud Gateway versions 3.1.x antérieures à 3.1.11
Spring Cloud Gateway Server Cloud Gateway versions 4.2.x antérieures à 4.2.5
Spring Cloud Gateway Server Cloud Gateway versions 4.1.x antérieures à 4.1.11
Spring Cloud Gateway Server Cloud Gateway versions 4.0.x antérieures à 4.1.11
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cloud Gateway versions 4.3.x ant\u00e9rieures \u00e0 4.3.1",
      "product": {
        "name": "Cloud Gateway Server",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Gateway versions 3.1.x ant\u00e9rieures \u00e0 3.1.11",
      "product": {
        "name": "Cloud Gateway Server",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Gateway versions 4.2.x ant\u00e9rieures \u00e0 4.2.5",
      "product": {
        "name": "Cloud Gateway Server",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Gateway versions 4.1.x ant\u00e9rieures \u00e0 4.1.11",
      "product": {
        "name": "Cloud Gateway Server",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Gateway versions 4.0.x ant\u00e9rieures \u00e0 4.1.11",
      "product": {
        "name": "Cloud Gateway Server",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-41243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41243"
    }
  ],
  "initial_release_date": "2025-09-09T00:00:00",
  "last_revision_date": "2025-09-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0763",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-09-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Spring Cloud Gateway. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Spring Cloud Gateway",
  "vendor_advisories": [
    {
      "published_at": "2025-09-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2025-41243",
      "url": "https://spring.io/security/cve-2025-41243"
    }
  ]
}

CERTFR-2025-AVI-0460
Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans Spring Cloud Gateway Server. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Spring Cloud Gateway Server Cloud Gateway Server versions 4.0.x antérieures à 4.0.12 (Commercial)
Spring Cloud Gateway Server Cloud Gateway Server versions 4.1.x antérieures à 4.1.8 (OSS)
Spring Cloud Gateway Server Cloud Gateway Server versions 4.2.x antérieures à 4.2.3 (OSS)
Spring Cloud Gateway Server Cloud Gateway Server versions 3.1.x antérieures à 3.1.10 (Commercial)
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cloud Gateway Server versions 4.0.x ant\u00e9rieures \u00e0 4.0.12 (Commercial)",
      "product": {
        "name": "Cloud Gateway Server",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Gateway Server versions 4.1.x ant\u00e9rieures \u00e0 4.1.8 (OSS)",
      "product": {
        "name": "Cloud Gateway Server",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Gateway Server versions 4.2.x ant\u00e9rieures \u00e0 4.2.3 (OSS)",
      "product": {
        "name": "Cloud Gateway Server",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Gateway Server versions 3.1.x ant\u00e9rieures \u00e0 3.1.10 (Commercial)",
      "product": {
        "name": "Cloud Gateway Server",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-41235",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41235"
    }
  ],
  "initial_release_date": "2025-05-30T00:00:00",
  "last_revision_date": "2025-05-30T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0460",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-05-30T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Spring Cloud Gateway Server. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Spring Cloud Gateway Server",
  "vendor_advisories": [
    {
      "published_at": "2025-05-27",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2025-41235",
      "url": "https://spring.io/security/cve-2025-41235"
    }
  ]
}