critical9.8Known exploited
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-04-04. Federal due date: 2022-04-25.
Apply updates per vendor instructions.
Impact
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Framework | before 5.2.20 from 5.3.0 before 5.3.18 |
| Cisco | Cx Cloud Agent | before 2.1.0 |
| Oracle | Communications Cloud Native Core Automated Test Suite | Versions 1.9.0, 22.1.0 |
| Oracle | Communications Cloud Native Core Console | Versions 1.9.0, 22.1.0 |
| Oracle | Communications Cloud Native Core Network Exposure Function | Version 22.1.0 |
| Oracle | Communications Cloud Native Core Network Function Cloud Native Environment | Versions 1.10.0, 22.1.0 |
| Oracle | Communications Cloud Native Core Network Repository Function | Versions 1.15.0, 22.1.0 |
| Oracle | Communications Cloud Native Core Network Slice Selection Function | Versions 1.8.0, 1.15.0, 22.1.0 |
| Oracle | Communications Cloud Native Core Policy | Versions 1.15.0, 22.1.0 |
| Oracle | Communications Cloud Native Core Security Edge Protection Proxy | Versions 1.7.0, 22.1.0 |
| Oracle | Communications Cloud Native Core Unified Data Repository | Versions 1.15.0, 22.1.0 |
| Oracle | Communications Policy Management | Version 12.6.0.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
- http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
- https://tanzu.vmware.com/security/cve-2022-22965
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
- http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
- https://tanzu.vmware.com/security/cve-2022-22965
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
- https://www.kb.cert.org/vuls/id/970766
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965