Good morning,

With the recent news of the Spring Framework vulnerability known as Spring4Shell, are Dell looking into this at all, as we have version 3.6.0.241 installed only recently to fix the Log4j vulnerabilities, but Nessus is now showing that our WMS server is vulnerable to Spring as well.

Path : C:\Program Files\DELL\WMS\Tomcat-9\webapps\wms-api\WEB-INF\lib\spring-core-5.3.14.jar
Installed version : 5.3.14
Fixed version : 5.3.18

Path : C:\Program Files\DELL\WMS\Tomcat-9\webapps\wms-api\WEB-INF\lib\reactor-spring-1.0.1.RELEASE.jar
Installed version : 1.0.1.RELEASE
Fixed version : 5.2.20

Path : C:\Program Files\DELL\WMS\Tomcat-9\webapps\ccm-web\WEB-INF\lib\spring-core-5.3.13.jar
Installed version : 5.3.13
Fixed version : 5.3.18

Thank you.