{
  "@id": "urn:uuid:c8bfd778-35be-4816-8764-1a19dfe768b2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T20:45:11.933877+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.2.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.2.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T20:45:11.933877+00:00",
      "status_notes": "Vulnerability CVE-2010-1622 does not affect version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.2.9.RELEASE. The vulnerability allowed remote code execution via HTTP request parameters binding to class.classLoader.URLs[0]. The upstream fix (commit 3a5af35d from May 2010) filters out the classLoader property during introspection of Class objects, preventing this attack vector. This fix was already included in Spring Framework 5.2.9.RELEASE...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-1622"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.2.9.RELEASE. The vulnerability allowed remote code execution via HTTP request parameters binding to class.classLoader.URLs[0]. The upstream fix (commit 3a5af35d from May 2010) filters out the classLoader property during introspection of Class objects, preventing this attack vector. This fix was already included in Spring Framework 5.2.9.RELEASE..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.2.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.2.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.2.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.2.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:40:33.053070+00:00",
      "status_notes": "Vulnerability CVE-2023-20860 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2023-20860"
      },
      "action_statement": "Vulnerability CVE-2023-20860 affects version 5.2.9.RELEASE-tuxcare.1 of org.springframework:spring."
    }
  ]
}