9.8
CVE-2022-22965
- EPSS 99.68%
- Veröffentlicht 01.04.2022 23:15:13
- Zuletzt bearbeitet 30.10.2025 19:56:43
- Erkennungen
LoginA Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Spring Framework Version < 5.2.20
VMware ≫ Spring Framework Version >= 5.3.0 < 5.3.18
Cisco ≫ Cx Cloud Agent Version < 2.1.0
Oracle ≫ Communications Cloud Native Core Automated Test Suite Version 1.9.0
Oracle ≫ Communications Cloud Native Core Automated Test Suite Version 22.1.0
Oracle ≫ Communications Cloud Native Core Console Version 1.9.0
Oracle ≫ Communications Cloud Native Core Console Version 22.1.0
Oracle ≫ Communications Cloud Native Core Network Exposure Function Version 22.1.0
Oracle ≫ Communications Cloud Native Core Network Repository Function Version 1.15.0
Oracle ≫ Communications Cloud Native Core Network Repository Function Version 22.1.0
Oracle ≫ Communications Cloud Native Core Network Slice Selection Function Version 1.15.0
Oracle ≫ Communications Cloud Native Core Network Slice Selection Function Version 22.1.0
Oracle ≫ Communications Cloud Native Core Policy Version 1.15.0
Oracle ≫ Communications Cloud Native Core Policy Version 22.1.0
Oracle ≫ Communications Cloud Native Core Security Edge Protection Proxy Version 22.1.0
Oracle ≫ Communications Cloud Native Core Unified Data Repository Version 1.15.0
Oracle ≫ Communications Cloud Native Core Unified Data Repository Version 22.1.0
Oracle ≫ Communications Policy Management Version 12.6.0.0.0
Oracle ≫ Financial Services Analytical Applications Infrastructure Version 8.1.1
Oracle ≫ Financial Services Analytical Applications Infrastructure Version 8.1.2.0
Oracle ≫ Financial Services Behavior Detection Platform Version 8.1.1.0
Oracle ≫ Financial Services Behavior Detection Platform Version 8.1.1.1
Oracle ≫ Financial Services Behavior Detection Platform Version 8.1.2.0
Oracle ≫ Financial Services Enterprise Case Management Version 8.1.1.0
Oracle ≫ Financial Services Enterprise Case Management Version 8.1.1.1
Oracle ≫ Financial Services Enterprise Case Management Version 8.1.2.0
Oracle ≫ Mysql Enterprise Monitor Version < 8.0.29
Oracle ≫ Product Lifecycle Analytics Version 3.6.1
Oracle ≫ Retail Xstore Point Of Service Version 20.0.1
Oracle ≫ Retail Xstore Point Of Service Version 21.0.0
Oracle ≫ Sd-wan Edge Version 9.0
Oracle ≫ Sd-wan Edge Version 9.1
Siemens ≫ Operation Scheduler Version < 2.0.4
Siemens ≫ Sipass Integrated Version 2.80
Siemens ≫ Sipass Integrated Version 2.85
Siemens ≫ Siveillance Identity Version 1.5
Siemens ≫ Siveillance Identity Version 1.6
Veritas ≫ Access Appliance Version 7.4.3
Veritas ≫ Access Appliance Version 7.4.3.100
Veritas ≫ Access Appliance Version 7.4.3.200
Veritas ≫ Access Appliance Version 7.4.3
Veritas ≫ Access Appliance Version 7.4.3.100
Veritas ≫ Access Appliance Version 7.4.3.200
Veritas ≫ Flex Appliance Version 1.3
Veritas ≫ Flex Appliance Version 2.0
Veritas ≫ Flex Appliance Version 2.0.1
Veritas ≫ Flex Appliance Version 2.0.2
Veritas ≫ Flex Appliance Version 2.1
Veritas ≫ Netbackup Flex Scale Appliance Version 2.1
Veritas ≫ Netbackup Flex Scale Appliance Version 3.0
Veritas ≫ Netbackup Appliance Version 4.0
Veritas ≫ Netbackup Appliance Version 4.0.0.1 Update maintenance_release1
Veritas ≫ Netbackup Appliance Version 4.0.0.1 Update maintenance_release2
Veritas ≫ Netbackup Appliance Version 4.0.0.1 Update maintenance_release3
Veritas ≫ Netbackup Appliance Version 4.1
Veritas ≫ Netbackup Appliance Version 4.1.0.1 Update maintenance_release1
Veritas ≫ Netbackup Appliance Version 4.1.0.1 Update maintenance_release2
Veritas ≫ Netbackup Virtual Appliance Version 4.0
Veritas ≫ Netbackup Virtual Appliance Version 4.0.0.1 Update maintenance_release1
Veritas ≫ Netbackup Virtual Appliance Version 4.0.0.1 Update maintenance_release2
Veritas ≫ Netbackup Virtual Appliance Version 4.0.0.1 Update maintenance_release3
Veritas ≫ Netbackup Virtual Appliance Version 4.1
Veritas ≫ Netbackup Virtual Appliance Version 4.1.0.1 Update maintenance_release1
Veritas ≫ Netbackup Virtual Appliance Version 4.1.0.1 Update maintenance_release2
Siemens ≫ Operation Scheduler Version < 2.0.4
Siemens ≫ Simatic Speech Assistant For Machines Version < 1.2.1
Siemens ≫ Sinec Network Management System Version < 1.0.3
Siemens ≫ Sipass Integrated Version 2.80
Siemens ≫ Sipass Integrated Version 2.85
Siemens ≫ Siveillance Identity Version 1.5
Siemens ≫ Siveillance Identity Version 1.6
Oracle ≫ Commerce Platform Version 11.3.2
Oracle ≫ Communications Cloud Native Core Binding Support Function Version 22.1.3
Oracle ≫ Communications Unified Inventory Management Version 7.4.1
Oracle ≫ Communications Unified Inventory Management Version 7.4.2
Oracle ≫ Communications Unified Inventory Management Version 7.5.0
Oracle ≫ Retail Bulk Data Integration Version 16.0.3
Oracle ≫ Retail Customer Management And Segmentation Foundation Version 17.0
Oracle ≫ Retail Customer Management And Segmentation Foundation Version 18.0
Oracle ≫ Retail Customer Management And Segmentation Foundation Version 19.0
Oracle ≫ Retail Financial Integration Version 14.1.3.2
Oracle ≫ Retail Financial Integration Version 15.0.3.1
Oracle ≫ Retail Financial Integration Version 16.0.3
Oracle ≫ Retail Financial Integration Version 19.0.1
Oracle ≫ Retail Integration Bus Version 14.1.3.2
Oracle ≫ Retail Integration Bus Version 15.0.3.1
Oracle ≫ Retail Integration Bus Version 16.0.3
Oracle ≫ Retail Integration Bus Version 19.0.1
Oracle ≫ Retail Merchandising System Version 16.0.3
Oracle ≫ Retail Merchandising System Version 19.0.1
Oracle ≫ Weblogic Server Version 12.2.1.3.0
Oracle ≫ Weblogic Server Version 12.2.1.4.0
Oracle ≫ Weblogic Server Version 14.1.1.0.0
04.04.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog
Spring Framework JDK 9+ Remote Code Execution Vulnerability
SchwachstelleSpring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
BeschreibungApply updates per vendor instructions.
Erforderliche Maßnahmen| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 99.68% | 0.999 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| NIST | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
| CISA-ADP | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-94 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
https://tanzu.vmware.com/security/cve-2022-22965
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
https://www.kb.cert.org/vuls/id/970766
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965