Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ciscoCiscoCISCO-SA-JAVA-SPRING-RCE-ZX9GUC67
HistoryApr 01, 2022 - 11:45 p.m.

Vulnerability in Spring Framework Affecting Cisco Products: March 2022

2022-04-0123:45:00
tools.cisco.com
105

0.975 High

EPSS

Percentile

100.0%

JSON

On March 31, 2022, the following critical vulnerability in the Spring Framework affecting Spring MVC and Spring WebFlux applications running on JDK 9+ was released:

CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+

For a description of this vulnerability, see VMware Spring Framework Security Vulnerability Report [“https://tanzu.vmware.com/security/cve-2022-22965”].

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67 [“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67”]

Affected configurations

Vulners
Node
ciscoemergency_responderMatchany
OR
ciscounity_connectionMatchany
OR
ciscounified_communications_managerMatchany
OR
ciscounified_communications_manager_im_and_presence_serviceMatchany
OR
ciscoprime_license_managerMatchany
OR
ciscoprime_collaboration_deploymentMatchany
OR
ciscofirepower_management_centerMatchany
OR
ciscoevolved_programmable_network_managerMatchany
OR
ciscofirepower_threat_defense_softwareMatchany
OR
ciscoiot_field_network_directorMatchany
OR
ciscohyperflex_hx_data_platformMatchany
OR
ciscounity_connectionMatchany
OR
ciscoemergency_responderMatchany
OR
ciscounity_connectionMatchany
OR
ciscounified_communications_managerMatchany
OR
ciscounified_communications_manager_im_and_presence_serviceMatchany
OR
ciscoprime_license_managerMatchany
OR
ciscoprime_collaboration_deploymentMatchany
OR
ciscofirepower_management_centerMatchany
OR
ciscoevolved_programmable_network_managerMatchany
OR
ciscofirepower_threat_defense_softwareMatchany
OR
ciscoiot_field_network_directorMatchany
OR
ciscohyperflex_hx_data_platformMatchany
OR
ciscounity_connectionMatchany

Related

thn 5
talosblog 1
githubexploit 53
nessus 12
trendmicroblog 3
redhat 7
rapid7blog 11
ubuntucve 1
msrc 4
nuclei 1
ibm 41
redhatcve 1
vmware 5
packetstorm 1
vaadin 1
openvas 3
cvelist 2
nvd 2
attackerkb 1
spring 3
veracode 1
osv 2
prion 2
debiancve 1
hivepro 3
cloudfoundry 1
checkpoint_advisories 1
cve 2
kitploit 2
metasploit 1
cisa_kev 1
github 1
zdt 1
ics 1
qualysblog 4
fortinet 1
paloalto 1
f5 1
cert 1
cisa 1
securelist 2
trellix 4
avleonov 1
mmpc 1
mssecure 1
impervablog 1
malwarebytes 1
checkpoint_security 1
thn
thn
Security Patch Releases for Critical Zero-Day Bug in Java Spring Framework
2022-03-31 15:35:00
Watch Out! Cryptocurrency Miners Targeting Dockers, AWS and Alibaba Cloud
2022-04-22 09:30:00
Hackers Exploited Atlassian Confluence Bug to Deploy Ljl Backdoor for Espionage
2022-08-04 10:24:00
talosblog
talosblog
Threat Advisory: Spring4Shell
2022-04-04 10:26:10
githubexploit
githubexploit
Exploit for Code Injection in Vmware Spring Framework
2022-04-01 12:18:29
Exploit for Code Injection in Vmware Spring Framework
2022-05-19 23:16:40
Exploit for Code Injection in Vmware Spring Framework
2022-11-28 14:34:51
nessus
nessus
Spring Framework Spring4Shell (CVE-2022-22965)
2022-04-06 00:00:00
Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-004)
2023-09-27 00:00:00
RHEL 8 : spring-framework (Unpatched Vulnerability)
2024-05-11 00:00:00
trendmicroblog
trendmicroblog
CVE-2022-22965: Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware
2022-04-08 00:00:00
Spring4Shell Vulnerability CVE-2022-22965 Exploited to Deploy Cryptocurrency Miners
2022-04-20 00:00:00
Analyzing Attempts to Exploit the Spring4Shell Vulnerability CVE-2022-22965 to Deploy Cryptocurrency Miners
2022-04-20 00:00:00
redhat
redhat
(RHSA-2022:1627) Low: Red Hat AMQ Broker 7.9.4 release and security update
2022-04-27 09:45:16
(RHSA-2022:1626) Low: Red Hat AMQ Broker 7.8.6 release and security update
2022-04-27 09:45:11
(RHSA-2022:1333) Low: Red Hat Integration Camel-K 1.6.5 security update
2022-04-12 18:28:41
rapid7blog
rapid7blog
It’s the Summer of AppSec: Q2 Improvements to Our Industry-Leading DAST and WAAP
2022-07-13 15:45:00
XSS in JSON: Old-School Attacks for Modern Applications
2022-05-04 15:48:03
Securing Your Applications Against Spring4Shell (CVE-2022-22965)
2022-04-01 22:26:36
ubuntucve
ubuntucve
CVE-2022-22965
2022-04-01 00:00:00
msrc
msrc
Microsoft’s Response to CVE-2022-22965 Spring Framework
2022-04-05 07:00:00
Microsoft’s Response to CVE-2022-22965 Spring Framework
2022-04-05 07:00:00
Microsoft’s Response to CVE-2022-22965 Spring Framework
2022-04-05 23:41:01
nuclei
nuclei
Spring - Remote Code Execution
2022-04-01 11:43:45
ibm
ibm
Security Bulletin: IBM Maximo For Civil infrastructure is vulnerable to a remote code execution in Spring Framework (CVE-2022-22965)
2022-04-11 15:15:01
Security Bulletin: IBM Spectrum Conductor is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)
2022-06-20 02:10:14
Security Bulletin: Rational Test Control Panel component in Rational Test Virtualization Server and Rational Test Workbench is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)
2022-06-16 17:10:46
redhatcve
redhatcve
CVE-2022-22965
2022-03-31 18:32:57
vmware
vmware
VMware Response to Spring Framework Remote Code Execution Vulnerability (CVE-2022-22965)
2022-04-02 00:00:00
VMware Response to Spring Framework Remote Code Execution Vulnerability (CVE-2022-22965)
2022-04-02 00:00:00
VMware Response to Spring Framework Remote Code Execution Vulnerability (CVE-2022-22965)
2022-04-02 00:00:00
packetstorm
packetstorm
Spring4Shell Spring Framework Class Property Remote Code Execution
2022-05-10 00:00:00
vaadin
vaadin
Spring Core Remote Code Execution via Data Binding on JDK 9+
2022-04-01 00:00:00
openvas
openvas
VMware Spring Framework RCE Vulnerability (Spring4Shell, SpringShell) - Active Check
2023-12-13 00:00:00
VMware Spring Boot RCE Vulnerability (Spring4Shell, SpringShell)
2022-04-06 00:00:00
VMware Spring Framework RCE Vulnerability (Spring4Shell, SpringShell) - Version Check
2022-03-31 00:00:00
cvelist
cvelist
CVE-2022-22965
2022-04-01 22:17:30
CVE-2022-43712
2023-07-26 00:00:00
nvd
nvd
CVE-2022-22965
2022-04-01 23:15:13
CVE-2022-43712
2023-07-26 14:15:09
attackerkb
attackerkb
CVE-2022-22965
2022-04-01 00:00:00
spring
spring
Spring Framework RCE, Mitigation Alternative
2022-04-01 11:49:00
Spring Framework Data Binding Rules Vulnerability (CVE-2022-22968)
2022-04-13 13:00:00
Spring Framework RCE, Early Announcement
2022-03-31 10:27:00
veracode
veracode
Remote Code Execution (RCE)
2022-03-31 00:56:39
osv
osv
Remote Code Execution in Spring Framework
2022-03-31 18:30:50
CVE-2022-22965
2022-04-01 23:15:13
prion
prion
Remote code execution
2022-04-01 23:15:00
Design/Logic Flaw
2023-07-26 14:15:00
debiancve
debiancve
CVE-2022-22965
2022-04-01 23:15:13
hivepro
hivepro
RCE Spring Framework Zero-Day vulnerability “Spring4Shell”
2022-04-12 02:21:11
Weekly Threat Digest: 4 – 10 April 2022
2022-04-13 06:34:35
Weekly Threat Digest: 28 March – 3 April 2022
2022-04-05 10:11:43
cloudfoundry
cloudfoundry
CVE-2022-22965: UAA affected by Spring Framework RCE via Data Binding on JDK 9+ | Cloud Foundry
2022-04-05 00:00:00
checkpoint_advisories
checkpoint_advisories
Spring Core Remote Code Execution (CVE-2022-22965)
2022-03-31 00:00:00
cve
cve
CVE-2022-22965
2022-04-01 23:15:13
CVE-2022-43712
2023-07-26 14:15:09
kitploit
kitploit
Spring4Shell-POC - Dockerized Spring4Shell (CVE-2022-22965) PoC Application And Exploit
2022-05-10 12:30:00
Spring4Shell-Scan - A Fully Automated, Reliable, And Accurate Scanner For Finding Spring4Shell And Spring Cloud RCE Vulnerabilities
2022-04-24 21:30:00
metasploit
metasploit
Spring Framework Class property RCE (Spring4Shell)
2022-04-07 13:22:18
cisa_kev
cisa_kev
Spring Framework JDK 9+ Remote Code Execution Vulnerability
2022-04-04 00:00:00
github
github
Remote Code Execution in Spring Framework
2022-03-31 18:30:50
zdt
zdt
Spring4Shell Spring Framework Class Property Remote Code Execution Exploit
2022-05-10 00:00:00
ics
ics
Hitachi Energy Lumada Asset Performance Management Prognostic Model Executor Service
2022-10-13 12:00:00
qualysblog
qualysblog
Spring Framework Zero-Day Remote Code Execution (Spring4Shell) Vulnerability
2022-03-31 09:00:00
Why Is Snapshot Scanning Not Enough?
2022-11-01 13:27:50
The January 2023 Oracle Critical Patch Update
2023-01-18 00:43:03
fortinet
fortinet
CVE-2022-22965 and CVE-2022-22963 vulnerabilities
2022-04-01 00:00:00
paloalto
paloalto
Informational: Impact of Spring Vulnerabilities CVE-2022-22963 and CVE-2022-22965
2022-03-31 02:30:00
f5
f5
K11510688 : Spring Framework (Spring4Shell) and Spring Cloud vulnerabilities CVE-2022-22965, CVE-2022-22950, and CVE-2022-22963
2022-03-31 00:00:00
cert
cert
Spring Framework insecurely handles PropertyDescriptor objects with data binding
2022-03-31 00:00:00
cisa
cisa
Spring Releases Security Updates Addressing "Spring4Shell" and Spring Cloud Function Vulnerabilities
2022-04-01 00:00:00
securelist
securelist
IT threat evolution Q2 2022
2022-08-15 12:00:34
Spring4Shell (CVE-2022-22965): details and mitigations
2022-04-04 15:30:36
trellix
trellix
The Bug Report – June 2022 Edition
2022-07-06 00:00:00
The Bug Report – June 2022 Edition
2022-07-06 00:00:00
The Bug Report – April 2022 Edition
2022-05-04 00:00:00
avleonov
avleonov
Spring4Shell, Spring Cloud Function RCE and Spring Cloud Gateway Code Injection
2022-04-03 00:15:45
mmpc
mmpc
SpringShell RCE vulnerability: Guidance for protecting against and detecting CVE-2022-22965
2022-04-05 01:11:24
mssecure
mssecure
SpringShell RCE vulnerability: Guidance for protecting against and detecting CVE-2022-22965
2022-04-05 01:11:24
impervablog
impervablog
Imperva Protects from New Spring Framework Zero-Day Vulnerabilities
2022-03-31 15:20:03
malwarebytes
malwarebytes
4 over-hyped security vulnerabilities of 2022
2022-12-19 01:00:00
checkpoint_security
checkpoint_security
Check Point Response to Spring Vulnerabilities CVE-2022-22963, CVE-2022-22946, CVE-2022-22947, CVE-2022-22965 (Spring4Shell) and CVE-2022-22950
2022-03-30 21:41:02

0.975 High

EPSS

Percentile

100.0%

JSON
Related for CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67
thn5talosblog1githubexploit53nessus12trendmicroblog3redhat7rapid7blog11ubuntucve1msrc4nuclei1ibm41redhatcve1vmware5packetstorm1vaadin1openvas3cvelist2nvd2attackerkb1spring3veracode1osv2prion2debiancve1hivepro3cloudfoundry1checkpoint_advisories1cve2kitploit2metasploit1cisa_kev1github1zdt1ics1qualysblog4fortinet1paloalto1f51cert1cisa1securelist2trellix4avleonov1mmpc1mssecure1impervablog1malwarebytes1checkpoint_security1