CVE-2022-22965

Published Apr 1, 2022

Last updated a month ago

Insights

Analysis from the Intruder Security Team
Published Oct 15, 2024

The vulnerability affects Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, as well as all older versions. For an application to be fully vulnerable to the currently (13/04/2020) known vectors, a number of pre-requisites are required for the application to be vulnerable.

More information is available in our blog post here.

Overview

Description
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Source
security@vmware.com
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

CVSS 2.0

Type
Primary
Base score
7.5
Impact score
6.4
Exploitability score
10
Vector string
AV:N/AC:L/Au:N/C:P/I:P/A:P

Known exploits

Data from CISA

Vulnerability name
Spring Framework JDK 9+ Remote Code Execution Vulnerability
Exploit added on
Apr 4, 2022
Exploit action due
Apr 25, 2022
Required action
Apply updates per vendor instructions.

Weaknesses

nvd@nist.gov
CWE-94
security@vmware.com
CWE-94

Social media

Hype score
Not currently trending

Configurations