{
  "@id": "urn:uuid:65794ed7-9ed7-4d2b-ac14-e0d1c7bb587f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T20:25:38.540107+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T20:25:38.540107+00:00",
      "status_notes": "Vulnerability CVE-2010-1622 does not affect version 5.3.7-tuxcare.4 of org.springframework:spring. not_affected \u2014 The target Spring Framework 5.3.7 is NOT affected by CVE-2010-1622. The vulnerability pattern (unrestricted data binding to Class.classLoader property) is not present because the upstream vendor fix was already included in Spring Framework 5.3.7 release. The fix filters out the \"classLoader\" property when introspecting Class objects, preventing the attack path described in the CVE. Additionally...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-1622"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.7 is NOT affected by CVE-2010-1622. The vulnerability pattern (unrestricted data binding to Class.classLoader property) is not present because the upstream vendor fix was already included in Spring Framework 5.3.7 release. The fix filters out the \"classLoader\" property when introspecting Class objects, preventing the attack path described in the CVE. Additionally..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 5.3.7-tuxcare.4 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-20860 is fixed in version 5.3.7-tuxcare.4 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2023-20860"
      }
    }
  ]
}