CVE-2022-22965
Spring Framework
At a glance
- Source
- NVD
- EPSS
- EPSS 99.64 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- vmware
- NVD status
- Analyzed
Description
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Weaknesses (CWE)
- CWE-94 — Improper Control of Generation of Code
References
- https://tanzu.vmware.com/security/cve-2022-22965
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
- http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
- https://www.kb.cert.org/vuls/id/970766
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-36p3-wjmg-h94x — Remote Code Execution in Spring Framework
European references
- ENISA EUVD · EUVD-2022-1283
- GCVE · GCVE-0-2022-22965
CERT-FR advisories
- CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2022-AVI-928 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-716 — Multiples vulnérabilités dans IBM Cloud Pak System · cert.ssi.gouv.fr
- CERTFR-2022-AVI-659 — Multiples vulnérabilités dans Oracle WebLogic · cert.ssi.gouv.fr
- CERTFR-2022-AVI-626 — Multiples vulnérabilités dans IBM i Modernization · cert.ssi.gouv.fr
- CERTFR-2022-AVI-572 — Vulnérabilité dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-568 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-539 — Multiples vulnérabilités dans IBM DB2 · cert.ssi.gouv.fr
- CERTFR-2022-AVI-523 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-494 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-487 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-481 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-472 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-456 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
- CERTFR-2022-AVI-376 — Multiples vulnérabilités dans Fortinet FortiSOAR · cert.ssi.gouv.fr
- CERTFR-2022-AVI-371 — Multiples vulnérabilités dans les produits Cisco · cert.ssi.gouv.fr
- CERTFR-2022-AVI-360 — Vulnérabilité dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2022-AVI-345 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
- CERTFR-2022-AVI-326 — Multiples vulnérabilités dans les produits SolarWinds · cert.ssi.gouv.fr
- CERTFR-2022-AVI-307 — Vulnérabilité dans VMware Tanzu · cert.ssi.gouv.fr
- CERTFR-2022-AVI-297 — Vulnérabilité dans VMware Spring · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*< 5.2.20cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*≥ 5.3.0 < 5.3.18cpe:2.3:a:cisco:cx_cloud_agent:*:*:*:*:*:*:*:*< 2.1.0cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:22.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_console:22.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.15.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*< 8.0.29cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*< 2.0.4cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*- +57 more
Affected products
| Product | Versions |
|---|---|
| Spring Framework | affected Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |