CVE-2022-22965

🗓️ 01 Apr 2022 22:17:30Reported by vmwareType

cve🔗 web.nvd.nist.gov📰️ 12 Media mentions👁 2637 Views

Spring MVC or Spring WebFlux on JDK 9+ vulnerable to RCE via data bindin

Reporter	Title	Published	Views	Family All 428
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	31 Mar 202219:19	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	20 Jun 202311:45	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	4 Apr 202210:37	–	githubexploit
GithubExploit	Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware	19 Mar 202615:19	–	githubexploit
GithubExploit	Exploit for CVE-2020-1938	29 Nov 202508:31	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	1 Mar 202620:00	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	5 Apr 202215:45	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	31 Mar 202215:01	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	2 Nov 202400:26	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Framework	14 Jan 202607:45	–	githubexploit

NVD

Vulners

Node

AND

vmware spring_frameworkRange<5.2.20

vmware spring_frameworkRange5.3.0–5.3.18

oracle jdkRange9≥

Node

cisco cx_cloud_agentRange<2.1.0

Node

oracle communications_cloud_native_core_automated_test_suiteMatch1.9.0

oracle communications_cloud_native_core_automated_test_suiteMatch22.1.0

oracle communications_cloud_native_core_consoleMatch1.9.0

oracle communications_cloud_native_core_consoleMatch22.1.0

oracle communications_cloud_native_core_network_exposure_functionMatch22.1.0

oracle communications_cloud_native_core_network_function_cloud_native_environmentMatch1.10.0

oracle communications_cloud_native_core_network_function_cloud_native_environmentMatch22.1.0

oracle communications_cloud_native_core_network_repository_functionMatch1.15.0

oracle communications_cloud_native_core_network_repository_functionMatch22.1.0

oracle communications_cloud_native_core_network_slice_selection_functionMatch1.8.0

oracle communications_cloud_native_core_network_slice_selection_functionMatch1.15.0

oracle communications_cloud_native_core_network_slice_selection_functionMatch22.1.0

oracle communications_cloud_native_core_policyMatch1.15.0

oracle communications_cloud_native_core_policyMatch22.1.0

oracle communications_cloud_native_core_security_edge_protection_proxyMatch1.7.0

oracle communications_cloud_native_core_security_edge_protection_proxyMatch22.1.0

oracle communications_cloud_native_core_unified_data_repositoryMatch1.15.0

oracle communications_cloud_native_core_unified_data_repositoryMatch22.1.0

oracle communications_policy_managementMatch12.6.0.0.0

oracle financial_services_analytical_applications_infrastructureMatch8.1.1

oracle financial_services_analytical_applications_infrastructureMatch8.1.2.0

oracle financial_services_behavior_detection_platformMatch8.1.1.0

oracle financial_services_behavior_detection_platformMatch8.1.1.1

oracle financial_services_behavior_detection_platformMatch8.1.2.0

oracle financial_services_enterprise_case_managementMatch8.1.1.0

oracle financial_services_enterprise_case_managementMatch8.1.1.1

oracle financial_services_enterprise_case_managementMatch8.1.2.0

oracle mysql_enterprise_monitorRange<8.0.29

oracle product_lifecycle_analyticsMatch3.6.1

oracle retail_xstore_point_of_serviceMatch20.0.1

oracle retail_xstore_point_of_serviceMatch21.0.0

oracle sd-wan_edgeMatch9.0

oracle sd-wan_edgeMatch9.1

siemens operation_schedulerRange<2.0.4

siemens sipass_integratedMatch2.80

siemens sipass_integratedMatch2.85

siemens siveillance_identityMatch1.5

siemens siveillance_identityMatch1.6

Node

veritas access_applianceMatch7.4.3

veritas access_applianceMatch7.4.3.100

veritas access_applianceMatch7.4.3.200

Node

veritas access_applianceMatch7.4.3

veritas access_applianceMatch7.4.3.100

veritas access_applianceMatch7.4.3.200

veritas flex_applianceMatch1.3

veritas flex_applianceMatch2.0

veritas flex_applianceMatch2.0.1

veritas flex_applianceMatch2.0.2

veritas flex_applianceMatch2.1

veritas netbackup_flex_scale_applianceMatch2.1

veritas netbackup_flex_scale_applianceMatch3.0

veritas netbackup_applianceMatch4.0

veritas netbackup_applianceMatch4.0.0.1maintenance_release1

veritas netbackup_applianceMatch4.0.0.1maintenance_release2

veritas netbackup_applianceMatch4.0.0.1maintenance_release3

veritas netbackup_applianceMatch4.1

veritas netbackup_applianceMatch4.1.0.1maintenance_release1

veritas netbackup_applianceMatch4.1.0.1maintenance_release2

veritas netbackup_virtual_applianceMatch4.0

veritas netbackup_virtual_applianceMatch4.0.0.1maintenance_release1

veritas netbackup_virtual_applianceMatch4.0.0.1maintenance_release2

veritas netbackup_virtual_applianceMatch4.0.0.1maintenance_release3

veritas netbackup_virtual_applianceMatch4.1

veritas netbackup_virtual_applianceMatch4.1.0.1maintenance_release1

veritas netbackup_virtual_applianceMatch4.1.0.1maintenance_release2

Node

siemens operation_schedulerRange<2.0.4

siemens simatic_speech_assistant_for_machinesRange<1.2.1

siemens sinec_network_management_systemRange<1.0.3

siemens sipass_integratedMatch2.80

siemens sipass_integratedMatch2.85

siemens siveillance_identityMatch1.5

siemens siveillance_identityMatch1.6

Node

oracle commerce_platformMatch11.3.2

oracle communications_cloud_native_core_binding_support_functionMatch22.1.3

oracle communications_unified_inventory_managementMatch7.4.1

oracle communications_unified_inventory_managementMatch7.4.2

oracle communications_unified_inventory_managementMatch7.5.0

oracle retail_bulk_data_integrationMatch16.0.3

oracle retail_customer_management_and_segmentation_foundationMatch17.0

oracle retail_customer_management_and_segmentation_foundationMatch18.0

oracle retail_customer_management_and_segmentation_foundationMatch19.0

oracle retail_financial_integrationMatch14.1.3.2

oracle retail_financial_integrationMatch15.0.3.1

oracle retail_financial_integrationMatch16.0.3

oracle retail_financial_integrationMatch19.0.1

oracle retail_integration_busMatch14.1.3.2

oracle retail_integration_busMatch15.0.3.1

oracle retail_integration_busMatch16.0.3

oracle retail_integration_busMatch19.0.1

oracle retail_merchandising_systemMatch16.0.3

oracle retail_merchandising_systemMatch19.0.1

oracle weblogic_serverMatch12.2.1.3.0

oracle weblogic_serverMatch12.2.1.4.0

oracle weblogic_serverMatch14.1.1.0.0

[
  {
    "product": "Spring Framework",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions"
      }
    ]
  }
]

Source	Link
psirt	www.psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
tanzu	www.tanzu.vmware.com/security/cve-2022-22965
oracle	www.oracle.com/security-alerts/cpujul2022.html
packetstormsecurity	www.packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
packetstormsecurity	www.packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
oracle	www.oracle.com/security-alerts/cpuapr2022.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
kb	www.kb.cert.org/vuls/id/970766