The vulnerability of the Spring Core module of the Spring Framework software platform allows attackers to execute arbitrary code.

🗓️ 31 Mar 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 10 Views

Spring Core vulnerability allows remote code execution via externally controlled input data for class selection.

Reporter	Title	Published	Views	Family All 317
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	31 Mar 202219:19	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	20 Jun 202311:45	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	4 Apr 202210:37	–	githubexploit
GithubExploit	Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware	19 Mar 202615:19	–	githubexploit
GithubExploit	Exploit for CVE-2020-1938	29 Nov 202508:31	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	1 Mar 202620:00	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	5 Apr 202215:45	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	31 Mar 202215:01	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	2 Nov 202400:26	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	14 Jan 202607:45	–	githubexploit

Vulners

Node

OR

pivotal_software spring_frameworkRange5.3.0–5.3.18

pivotal_software spring_frameworkRange5.2.0–5.2.20

Source	Link
github	www.github.com/BobTheShoplifter/Spring4Shell-POC
cyberkendra	www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html
bugalert	www.bugalert.org/content/notices/2022-03-29-spring.html
lunasec	www.lunasec.io/docs/blog/spring-rce-vulnerabilities/
websecured	www.websecured.io/blog/624411cf775ad17d72274d16/spring4shell-poc
springcloud	www.springcloud.io/post/2022-03/spring-0day-vulnerability
safe-surf	www.safe-surf.ru/upload/ALRT/ALRT-20220331.1.pdf
tanzu	www.tanzu.vmware.com/security/CVE-2022-22965
spring	www.spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.6/

22 May 2026 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 38.8

CVSS 210

EPSS0.99677

Spring Core module Spring Framework externally controlled input class selection remote code execution