CVE-2022-22965

critical-risk
Published 2022-04-01

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Do I need to act?

!
94.4% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Cisco Oracle Siemens Vmware Veritas

References (18)

Exploit http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
Third Party Advisory http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-...
Patch https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
Third Party Advisory https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
Mitigation https://tanzu.vmware.com/security/cve-2022-22965
Third Party Advisory https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-j...
Third Party Advisory https://www.oracle.com/security-alerts/cpuapr2022.html
Patch https://www.oracle.com/security-alerts/cpujul2022.html
Exploit http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
Third Party Advisory http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-...
Patch https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
Third Party Advisory https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
Mitigation https://tanzu.vmware.com/security/cve-2022-22965
Third Party Advisory https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-j...
US Government Resource https://www.kb.cert.org/vuls/id/970766
Third Party Advisory https://www.oracle.com/security-alerts/cpuapr2022.html
Patch https://www.oracle.com/security-alerts/cpujul2022.html
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-...
88
/ 100
critical-risk
Severity 32/34 · Critical
Exploitability 27/34 · High
Exposure 29/34 · Critical