{
  "@id": "urn:uuid:58346822-58ea-479f-b431-3e8884b19320",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T20:25:38.540107+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T20:25:38.540107+00:00",
      "status_notes": "Vulnerability CVE-2010-1622 does not affect version 5.3.7-tuxcare.1 of org.springframework:spring. not_affected \u2014 The target Spring Framework 5.3.7 is NOT affected by CVE-2010-1622. The vulnerability pattern (unrestricted data binding to Class.classLoader property) is not present because the upstream vendor fix was already included in Spring Framework 5.3.7 release. The fix filters out the \"classLoader\" property when introspecting Class objects, preventing the attack path described in the CVE. Additionally...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-1622"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.7 is NOT affected by CVE-2010-1622. The vulnerability pattern (unrestricted data binding to Class.classLoader property) is not present because the upstream vendor fix was already included in Spring Framework 5.3.7 release. The fix filters out the \"classLoader\" property when introspecting Class objects, preventing the attack path described in the CVE. Additionally..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.3.7-tuxcare.1 of org.springframework:spring, and is fixed in 5.3.7-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.3.7-tuxcare.1 of org.springframework:spring, and is fixed in 5.3.7-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-20860 affects version 5.3.7-tuxcare.1 of org.springframework:spring, and is fixed in 5.3.7-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2023-20860"
      },
      "action_statement": "Vulnerability CVE-2023-20860 affects version 5.3.7-tuxcare.1 of org.springframework:spring, and is fixed in 5.3.7-tuxcare.2."
    }
  ]
}