Critical severity · published Apr 1, 2022
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
In wildKEV
9.8
CVSS
99.6%
EPSS
Yes
On KEV
Description
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.6% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Apr 4, 2022
Federal remediation dueApr 25, 2022
Ransomware campaign useNot known
Affected products
Which versions
WS
WebLogic Server · Oracle
12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 · source: NVD
SF
Spring Framework ·
Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions · source: vendor, NVD, KEV
AA
Access Appliance · Veritas
7.4.3; 7.4.3.100; 7.4.3.200; 7.4.3; 7.4.3.100; 7.4.3.200 · source: NVD
CC
CX Cloud Agent · Cisco
before 2.1.0 · source: NVD
CP
Commerce Platform · Oracle
11.3.2 · source: NVD
CC
Communications Cloud Native Core Automated Test Suite · Oracle
1.9.0; 22.1.0 · source: NVD
CC
Communications Cloud Native Core Binding Support Function · Oracle
22.1.3 · source: NVD
CC
Communications Cloud Native Core Console · Oracle
1.9.0; 22.1.0 · source: NVD
CC
Communications Cloud Native Core Network Exposure Function · Oracle
22.1.0 · source: NVD
CC
Communications Cloud Native Core Network Function Cloud Native Environment · Oracle
1.10.0; 22.1.0 · source: NVD
CC
Communications Cloud Native Core Network Repository Function · Oracle
1.15.0; 22.1.0 · source: NVD
CC
Communications Cloud Native Core Network Slice Selection Function · Oracle
1.8.0; 1.15.0; 22.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-22965
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-22965
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://tanzu.vmware.com/security/cve-2022-22965
vendor-advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html
x_refsource_CONFIRM
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
x_refsource_MISC
http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
x_refsource_CONFIRM
https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
More from WebLogic Server
9.8
CVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14644
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-2883
Oracle WebLogic Server Unspecified Vulnerability
9.8
CVE-2020-2551
Oracle Fusion Middleware Unspecified Vulnerability