Security Compliance

Why SolarWinds SEM and DPA are not affected by CVE-2024-22243, CVE-2024-22259, or CVE-2024-22262

This article explains why SolarWinds© Security Event Manager (SEM) and Database Performance Monitor (DPA) are not affected by a vulnerability in the Spring Framework.

First published date

3/13/2024 4:08 PM

Last published date

2/12/2025 9:39 PM

Overview

In 2024, Spring Security identified the security vulnerability described below:

Applications that use URIComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to an open redirect attack OR an SSRF attack if the URL is used after passing validation checks.

These three CVEs describe the same vulnerability but with different inputs:

  • CVE-2024-22243 (© 2024 National Institute of Standards and Technology, available at nvd.nist.gov, obtained on March 12, 2024)
  • CVE-2024-22259 (© 2024 National Institute of Standards and Technology, available at nvd.nist.gov, obtained on June 12, 2024)
  • CVE-2024-22262 © 2024 National Institute of Standards and Technology, available at nvd.nist.gov, obtained on June 12, 2024)

The vulnerability described in these CVEs impacts numerous software companies. 

 

Product section

Security Event Manager

Cause

CVE-2024-22243, CVE-2024-22259, and CVE-2024-22262

 

Resolution

This vulnerability requires the use of URLComponentsBuilder, which is not used in SEM or DPA. Therefore, the vulnerability does not apply to either SEM or DPA.