Lucene search

CVE-2022-22965

🗓️ 01 Apr 2022 23:13:15Reported by vmwareType

cve🔗 web.nvd.nist.gov👁 1890 Views🌐 26 Media mentions

Spring MVC or Spring WebFlux on JDK 9+ vulnerable to RCE via data bindin

Reporter	Title	Published	Views	Family All 199
GithubExploit	Exploit for Code Injection in Vmware Spring Framework	7 Jun 202309:02	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring Framework	30 Mar 202214:35	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring Framework	1 Apr 202213:46	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring Framework	6 Apr 202204:17	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring Framework	28 Dec 202204:50	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring Framework	4 Apr 202213:35	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring Framework	31 Mar 202213:02	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring Framework	28 Nov 202214:34	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring Framework	1 Apr 202212:18	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring Framework	1 Apr 202212:37	–	githubexploit

Nvd

Node

vmware spring_frameworkRange<5.2.20

vmware spring_frameworkRange5.3.0–5.3.18

AND

oracle jdkRange9≥

Node

cisco cx_cloud_agentRange<2.1.0

Node

oracle communications_cloud_native_core_automated_test_suiteMatch1.9.0

oracle communications_cloud_native_core_automated_test_suiteMatch22.1.0

oracle communications_cloud_native_core_consoleMatch1.9.0

oracle communications_cloud_native_core_consoleMatch22.1.0

oracle communications_cloud_native_core_network_exposure_functionMatch22.1.0

oracle communications_cloud_native_core_network_function_cloud_native_environmentMatch1.10.0

oracle communications_cloud_native_core_network_function_cloud_native_environmentMatch22.1.0

oracle communications_cloud_native_core_network_repository_functionMatch1.15.0

oracle communications_cloud_native_core_network_repository_functionMatch22.1.0

oracle communications_cloud_native_core_network_slice_selection_functionMatch1.8.0

oracle communications_cloud_native_core_network_slice_selection_functionMatch1.15.0

oracle communications_cloud_native_core_network_slice_selection_functionMatch22.1.0

oracle communications_cloud_native_core_policyMatch1.15.0

oracle communications_cloud_native_core_policyMatch22.1.0

oracle communications_cloud_native_core_security_edge_protection_proxyMatch1.7.0

oracle communications_cloud_native_core_security_edge_protection_proxyMatch22.1.0

oracle communications_cloud_native_core_unified_data_repositoryMatch1.15.0

oracle communications_cloud_native_core_unified_data_repositoryMatch22.1.0

oracle communications_policy_managementMatch12.6.0.0.0

oracle financial_services_analytical_applications_infrastructureMatch8.1.1

oracle financial_services_analytical_applications_infrastructureMatch8.1.2.0

oracle financial_services_behavior_detection_platformMatch8.1.1.0

oracle financial_services_behavior_detection_platformMatch8.1.1.1

oracle financial_services_behavior_detection_platformMatch8.1.2.0

oracle financial_services_enterprise_case_managementMatch8.1.1.0

oracle financial_services_enterprise_case_managementMatch8.1.1.1

oracle financial_services_enterprise_case_managementMatch8.1.2.0

oracle mysql_enterprise_monitorRange<8.0.29

oracle product_lifecycle_analyticsMatch3.6.1

oracle retail_xstore_point_of_serviceMatch20.0.1

oracle retail_xstore_point_of_serviceMatch21.0.0

oracle sd-wan_edgeMatch9.0

oracle sd-wan_edgeMatch9.1

siemens operation_schedulerRange<2.0.4

siemens sipass_integratedMatch2.80

siemens sipass_integratedMatch2.85

siemens siveillance_identityMatch1.5

siemens siveillance_identityMatch1.6

Node

veritas access_applianceMatch7.4.3

veritas access_applianceMatch7.4.3.100

veritas access_applianceMatch7.4.3.200

Node

veritas access_applianceMatch7.4.3

veritas access_applianceMatch7.4.3.100

veritas access_applianceMatch7.4.3.200

veritas flex_applianceMatch1.3

veritas flex_applianceMatch2.0

veritas flex_applianceMatch2.0.1

veritas flex_applianceMatch2.0.2

veritas flex_applianceMatch2.1

veritas netbackup_flex_scale_applianceMatch2.1

veritas netbackup_flex_scale_applianceMatch3.0

veritas netbackup_applianceMatch4.0

veritas netbackup_applianceMatch4.0.0.1maintenance_release1

veritas netbackup_applianceMatch4.0.0.1maintenance_release2

veritas netbackup_applianceMatch4.0.0.1maintenance_release3

veritas netbackup_applianceMatch4.1

veritas netbackup_applianceMatch4.1.0.1maintenance_release1

veritas netbackup_applianceMatch4.1.0.1maintenance_release2

veritas netbackup_virtual_applianceMatch4.0

veritas netbackup_virtual_applianceMatch4.0.0.1maintenance_release1

veritas netbackup_virtual_applianceMatch4.0.0.1maintenance_release2

veritas netbackup_virtual_applianceMatch4.0.0.1maintenance_release3

veritas netbackup_virtual_applianceMatch4.1

veritas netbackup_virtual_applianceMatch4.1.0.1maintenance_release1

veritas netbackup_virtual_applianceMatch4.1.0.1maintenance_release2

Node

siemens operation_schedulerRange<2.0.4

siemens simatic_speech_assistant_for_machinesRange<1.2.1

siemens sinec_network_management_systemRange<1.0.3

siemens sipass_integratedMatch2.80

siemens sipass_integratedMatch2.85

siemens siveillance_identityMatch1.5

siemens siveillance_identityMatch1.6

Node

oracle commerce_platformMatch11.3.2

oracle communications_cloud_native_core_binding_support_functionMatch22.1.3

oracle communications_unified_inventory_managementMatch7.4.1

oracle communications_unified_inventory_managementMatch7.4.2

oracle communications_unified_inventory_managementMatch7.5.0

oracle retail_bulk_data_integrationMatch16.0.3

oracle retail_customer_management_and_segmentation_foundationMatch17.0

oracle retail_customer_management_and_segmentation_foundationMatch18.0

oracle retail_customer_management_and_segmentation_foundationMatch19.0

oracle retail_financial_integrationMatch14.1.3.2

oracle retail_financial_integrationMatch15.0.3.1

oracle retail_financial_integrationMatch16.0.3

oracle retail_financial_integrationMatch19.0.1

oracle retail_integration_busMatch14.1.3.2

oracle retail_integration_busMatch15.0.3.1

oracle retail_integration_busMatch16.0.3

oracle retail_integration_busMatch19.0.1

oracle retail_merchandising_systemMatch16.0.3

oracle retail_merchandising_systemMatch19.0.1

oracle weblogic_serverMatch12.2.1.3.0

oracle weblogic_serverMatch12.2.1.4.0

oracle weblogic_serverMatch14.1.1.0.0

[
  {
    "product": "Spring Framework",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
oracle	www.oracle.com/security-alerts/cpujul2022.html
psirt	www.psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
oracle	www.oracle.com/security-alerts/cpuapr2022.html
packetstormsecurity	www.packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
tanzu	www.tanzu.vmware.com/security/cve-2022-22965
kb	www.kb.cert.org/vuls/id/970766

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

01 Apr 2022 23:15Current

8.7High risk

Vulners AI Score8.7

CVSS27.5

CVSS39.8

EPSS0.974