spring framework vulnerability not detected (CVE-2022-22968)

The defect may already be reported! Please search for the defect before creating one.

### Current Behavior:
Analysis of a project's SBOM does not show any vulnerabilities although project is affected. The project includes spring-core v5.3.18 which is affected by the following vulnerability https://tanzu.vmware.com/security/cve-2022-22968.

### Steps to Reproduce:
(Extract of the created SBOM)
```

{
"bomFormat": "CycloneDX",
"specVersion": "1.3",
"serialNumber": "urn:uuid:9369d571-2077-45ea-885a-2faddd4baaf4",
"version": 1,
"metadata": {
"timestamp": "2022-05-04T08:22:36Z",
"tools": [
{
"vendor": "OWASP",
"name": "Dependency-Track",
"version": "4.3.6"
}
],
"component": {
"name": "component",
"version": "main",
"type": "library"
}
},
"components": [
{
"group": "org.springframework",
"name": "spring-core",
"version": "5.3.18",
"description": "Spring Core",
"hashes": [
{
"alg": "MD5",
"content": "91eb16af497ab752763f5bb24e1239e7"
},
{
"alg": "SHA-1",
"content": "7ff3000f3342989cb011b6095a0e86f2e5176cef"
},
{
"alg": "SHA-256",
"content": "ca6fbdcf571fe1ee036d8e0b990175169baf629d38a8714f59e0e0fdc8f7a361"
},
{
"alg": "SHA-512",
"content": "0b687ac0ae4ca715a451f50a221bb317fec0fc5bfec5962454a91bb0158da6ad49a79ded964158a2bbdc5733cc829489b9ee56759684644a757d613daaf18dd1"
},
{
"alg": "SHA3-256",
"content": "8190f9815df340fe3019584d8b6f72b091f82f82663ea9597ceeb18295631528"
},
{
"alg": "SHA3-512",
"content": "e5d8c1ca790bf535db1330a061629a11cd26445cd0d81412dbf1525966796cdfe560e690b0d30de7ebb3f54eb8e8c63fc1f82eb819a270020161e2005d7a7a3d"
}
],
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"purl": "pkg:maven/org.springframework/spring-core@5.3.18?type=jar",
"type": "library",
"bom-ref": "e72c0b82-31b2-4293-935a-5b8bfc935c92"
}
],
"services": []
}

```

### Expected Behavior:
something like produced by grype:

grype sbom:/Users/user/Downloads/spring-core-sbom.json -o table
✔ Vulnerability DB [updated]
✔ Scanned image [1 vulnerabilities]
[0005] WARN some package(s) are missing CPEs. This may result in missing vulnerabilities. You may autogenerate these using: --add-cpes-if-none
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
spring-core 5.3.18 5.3.19 java-archive GHSA-g5mm-vmx4-3rg7 Low

### Environment:

- Dependency-Track Version: v4.3.6
- Distribution: Docker
- BOM Format & Version: CycloneDX1.3
- Database Server: PostgreSQL
- Browser: Chrome

### Additional Details:

(e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. stackoverflow, gitter, etc)

Start by importing the supplied CycloneDX 1.3 SBOM into Dependency-Track v4.3.6 and checking how org.springframework:spring-core:5.3.18 is matched against CVE-2022-22968 and the Grype result. Done means the affected component is identified and the vulnerability appears with the expected fixed version, 5.3.19.

Written by the indexing model from the issue text.