Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Published

2022-04-01T23:15:13.870

Last Modified

2025-04-10T16:56:46.083

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-94
Type: Primary
CWE-94

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	vmware	spring_framework	< 5.2.20	Yes
Application	vmware	spring_framework	< 5.3.18	Yes
Application	oracle	jdk	≥ 9	No
Application	cisco	cx_cloud_agent	< 2.1.0	Yes
Application	oracle	communications_cloud_native_core_automated_test_suite	1.9.0	Yes
Application	oracle	communications_cloud_native_core_automated_test_suite	22.1.0	Yes
Application	oracle	communications_cloud_native_core_console	1.9.0	Yes
Application	oracle	communications_cloud_native_core_console	22.1.0	Yes
Application	oracle	communications_cloud_native_core_network_exposure_function	22.1.0	Yes
Application	oracle	communications_cloud_native_core_network_function_cloud_native_environment	1.10.0	Yes
Application	oracle	communications_cloud_native_core_network_function_cloud_native_environment	22.1.0	Yes
Application	oracle	communications_cloud_native_core_network_repository_function	1.15.0	Yes
Application	oracle	communications_cloud_native_core_network_repository_function	22.1.0	Yes
Application	oracle	communications_cloud_native_core_network_slice_selection_function	1.8.0	Yes
Application	oracle	communications_cloud_native_core_network_slice_selection_function	1.15.0	Yes
Application	oracle	communications_cloud_native_core_network_slice_selection_function	22.1.0	Yes
Application	oracle	communications_cloud_native_core_policy	1.15.0	Yes
Application	oracle	communications_cloud_native_core_policy	22.1.0	Yes
Application	oracle	communications_cloud_native_core_security_edge_protection_proxy	1.7.0	Yes
Application	oracle	communications_cloud_native_core_security_edge_protection_proxy	22.1.0	Yes
Application	oracle	communications_cloud_native_core_unified_data_repository	1.15.0	Yes
Application	oracle	communications_cloud_native_core_unified_data_repository	22.1.0	Yes
Application	oracle	communications_policy_management	12.6.0.0.0	Yes
Application	oracle	financial_services_analytical_applications_infrastructure	8.1.1	Yes
Application	oracle	financial_services_analytical_applications_infrastructure	8.1.2.0	Yes
Application	oracle	financial_services_behavior_detection_platform	8.1.1.0	Yes
Application	oracle	financial_services_behavior_detection_platform	8.1.1.1	Yes
Application	oracle	financial_services_behavior_detection_platform	8.1.2.0	Yes
Application	oracle	financial_services_enterprise_case_management	8.1.1.0	Yes
Application	oracle	financial_services_enterprise_case_management	8.1.1.1	Yes
Application	oracle	financial_services_enterprise_case_management	8.1.2.0	Yes
Application	oracle	mysql_enterprise_monitor	< 8.0.29	Yes
Application	oracle	product_lifecycle_analytics	3.6.1	Yes
Application	oracle	retail_xstore_point_of_service	20.0.1	Yes
Application	oracle	retail_xstore_point_of_service	21.0.0	Yes
Application	oracle	sd-wan_edge	9.0	Yes
Application	oracle	sd-wan_edge	9.1	Yes
Application	siemens	operation_scheduler	< 2.0.4	Yes
Application	siemens	sipass_integrated	2.80	Yes
Application	siemens	sipass_integrated	2.85	Yes
Application	siemens	siveillance_identity	1.5	Yes
Application	siemens	siveillance_identity	1.6	Yes
Application	veritas	access_appliance	7.4.3	Yes
Application	veritas	access_appliance	7.4.3.100	Yes
Application	veritas	access_appliance	7.4.3.200	Yes
Application	veritas	access_appliance	7.4.3	Yes
Application	veritas	access_appliance	7.4.3.100	Yes
Application	veritas	access_appliance	7.4.3.200	Yes
Application	veritas	flex_appliance	1.3	Yes
Application	veritas	flex_appliance	2.0	Yes
Application	veritas	flex_appliance	2.0.1	Yes
Application	veritas	flex_appliance	2.0.2	Yes
Application	veritas	flex_appliance	2.1	Yes
Application	veritas	netbackup_flex_scale_appliance	2.1	Yes
Application	veritas	netbackup_flex_scale_appliance	3.0	Yes
Hardware	veritas	netbackup_appliance	4.0	Yes
Hardware	veritas	netbackup_appliance	4.0.0.1	Yes
Hardware	veritas	netbackup_appliance	4.0.0.1	Yes
Hardware	veritas	netbackup_appliance	4.0.0.1	Yes
Hardware	veritas	netbackup_appliance	4.1	Yes
Hardware	veritas	netbackup_appliance	4.1.0.1	Yes
Hardware	veritas	netbackup_appliance	4.1.0.1	Yes
Hardware	veritas	netbackup_virtual_appliance	4.0	Yes
Hardware	veritas	netbackup_virtual_appliance	4.0.0.1	Yes
Hardware	veritas	netbackup_virtual_appliance	4.0.0.1	Yes
Hardware	veritas	netbackup_virtual_appliance	4.0.0.1	Yes
Hardware	veritas	netbackup_virtual_appliance	4.1	Yes
Hardware	veritas	netbackup_virtual_appliance	4.1.0.1	Yes
Hardware	veritas	netbackup_virtual_appliance	4.1.0.1	Yes
Application	siemens	operation_scheduler	< 2.0.4	Yes
Application	siemens	simatic_speech_assistant_for_machines	< 1.2.1	Yes
Application	siemens	sinec_network_management_system	< 1.0.3	Yes
Application	siemens	sipass_integrated	2.80	Yes
Application	siemens	sipass_integrated	2.85	Yes
Application	siemens	siveillance_identity	1.5	Yes
Application	siemens	siveillance_identity	1.6	Yes
Application	oracle	commerce_platform	11.3.2	Yes
Application	oracle	communications_cloud_native_core_binding_support_function	22.1.3	Yes
Application	oracle	communications_unified_inventory_management	7.4.1	Yes
Application	oracle	communications_unified_inventory_management	7.4.2	Yes
Application	oracle	communications_unified_inventory_management	7.5.0	Yes
Application	oracle	retail_bulk_data_integration	16.0.3	Yes
Application	oracle	retail_customer_management_and_segmentation_foundation	17.0	Yes
Application	oracle	retail_customer_management_and_segmentation_foundation	18.0	Yes
Application	oracle	retail_customer_management_and_segmentation_foundation	19.0	Yes
Application	oracle	retail_financial_integration	14.1.3.2	Yes
Application	oracle	retail_financial_integration	15.0.3.1	Yes
Application	oracle	retail_financial_integration	16.0.3	Yes
Application	oracle	retail_financial_integration	19.0.1	Yes
Application	oracle	retail_integration_bus	14.1.3.2	Yes
Application	oracle	retail_integration_bus	15.0.3.1	Yes
Application	oracle	retail_integration_bus	16.0.3	Yes
Application	oracle	retail_integration_bus	19.0.1	Yes
Application	oracle	retail_merchandising_system	16.0.3	Yes
Application	oracle	retail_merchandising_system	19.0.1	Yes
Application	oracle	weblogic_server	12.2.1.3.0	Yes
Application	oracle	weblogic_server	12.2.1.4.0	Yes
Application	oracle	weblogic_server	14.1.1.0.0	Yes

References

http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html Exploit, Third Party Advisory, VDB Entry ([email protected])
http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html Third Party Advisory, VDB Entry ([email protected])
https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf Patch, Third Party Advisory ([email protected])
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005 Third Party Advisory ([email protected])
https://tanzu.vmware.com/security/cve-2022-22965 Mitigation, Vendor Advisory ([email protected])
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67 Third Party Advisory ([email protected])
https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory ([email protected])
https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory ([email protected])
http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://tanzu.vmware.com/security/cve-2022-22965 Mitigation, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.kb.cert.org/vuls/id/970766 US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)