{"cve":"CVE-2022-43484","nvd":{"published":"2022-12-05T04:15:10.343","modified":"2026-06-17T05:06:38.737","status":"Modified","description":"TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1 are vulnerable to a ClassLoader manipulation vulnerability due to using the old version of Spring Framework which contains the vulnerability.The vulnerability is caused by an improper input validation issue in the binding mechanism of Spring MVC. By the application processing a specially crafted file, arbitrary code may be executed with the privileges of the application.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-20"],"references":["http://terasolunaorg.github.io/vulnerability/cve-2022-43484.html","https://jvn.jp/en/jp/JVN54728399/index.html","https://osdn.net/projects/terasoluna/wiki/cve-2022-43484","http://terasolunaorg.github.io/vulnerability/cve-2022-43484.html","https://jvn.jp/en/jp/JVN54728399/index.html"],"products":["nttdata:terasoluna_global_framework","nttdata:terasoluna_server_framework_for_java_\\(rich\\)"],"source":"nvd","synced_at":"2026-10-19T21:37:28.463369388+00:00"},"epss":{"cve":"CVE-2022-43484","score":0.00419,"percentile":0.36263,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-q5j9-f95w-f4pr","url":"https://osv.dev/vulnerability/GHSA-q5j9-f95w-f4pr","summary":"TERASOLUNA Server Framework vulnerable to ClassLoader manipulation","modified":"2023-11-08T04:10:44.314402Z","packages":[{"ecosystem":"Maven","name":"org.terasoluna.gfw:terasoluna-gfw-common","purl":"pkg:maven/org.terasoluna.gfw/terasoluna-gfw-common","ranges":["<1.0.1.RELEASE"],"fixed":["1.0.1.RELEASE"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}