spring-rce-poc

spring-rce-poc Testing CVE-2022-22968 Simple app vulnerable to CVE-2022-22968 Dockerfile could be used to build it on vulnerable version of Tomcat 9.0.59 exploit.sh is a shell script which is trying to exploit this cve on 8080 port of localhost If attack with exploit.sh was succesfull, on context...

ROOT-APP-MAVEN-CVE-2022-22968 CVE-2022-22968 in org.springframework:spring-context - Patched by Root

Root has patched CVE-2022-22968 in the org.springframework:spring-context package for Root:Maven. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2022-22968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitiv...

Spring Framework DataBinder Case Sensitive Match Exception

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase has some Locale dependent exceptions that could potentially result in fields not protected as expected...

CVE-2024-38820

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase has some Locale dependent exceptions that could potentially result in fields not protected as expected...

CVE-2024-38820 CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase has some Locale dependent exceptions that could potentially result in fields not protected as expected...

CVE-2024-38820

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase has some Locale dependent exceptions that could potentially result in fields not protected as expected...

K35802610: Multiple MySQL vulnerabilities CVE-2022-21569, CVE-2022-21824, CVE-2022-22968, CVE-2022-27778

Security Advisory Description CVE-2022-21569 Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocol...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Spring Framework

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Spring Framework. Vulnerability Details CVEID:CVE-2022-22971 DESCRIPTION: Vmware Tanzu Spring Framework is vulnerable to a denial of service, caused by a flaw with a STOMP over WebSocket endpoint. By sending ...

Important: Red Hat Security Advisory: Red Hat AMQ Broker 7.10.0 release and security update

Red Hat AMQ Broker 7.10.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Security Bulletin: Due to use of Spring Framework, IBM Db2 Web Query for i is vulnerable to unprotected fields (CVE-2022-22968), remote code execution (CVE-2022-22965), and denial of service (CVE-2022-22950).

Summary There are multiple vulnerabilities in Spring Framework CVE-2022-22968, CVE-2022-22965, and CVE-2022-22950 as described in the vulnerability details section. Spring Framework v5.3.8 is used by Db2 Web Query for i for infrastructure support. IBM has addressed the vulnerabilities in Db2 Web...

Security Bulletin: IBM Common Licensing is vulnerable by a remote code attack in Spring Framework (CVE-2021-22096,CVE-2021-22060,CVE-2022-22950,CVE-2022-22968)

Summary IBM Common Licensing is vulnerable to a remote code execution in Spring Framework CVE-2021-22096,CVE-2021-22060,CVE-2022-22950,CVE-2022-22968 as it does have Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions. The fix includes Spring Framework version 5.3.19...

Exploit for Improper Handling of Case Sensitivity in Vmware Spring_Framework

spring-rce-poc Testing CVE-2022-22968 Simple app vulnerable...

CVE-2022-22968

creationtimestamp| type| source ---|---|--- 2022-04-15 00:23:46+00:00| seen| https://t.me/cibsecurity/40833 2022-05-12 18:30:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/2177 2022-05-13 02:27:01+00:00| published-proof-of-concept| https://t.me/BlueRedTeam/2071 2024-10-18...

cc.kebei:onion-expands-office (>=3.0.3, <=3.0.6), cc.kebei:onion-expands-script (>=3.0.3, <=3.0.6) +543 more potentially affected by CVE-2022-22968 via org.springframework:spring-context (4.3.23.release)

org.springframework:spring-context MAVEN version 4.3.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - cc.kebei:onion-expands-office =3.0.3, =3.0.3, =3.0.3, =3.0.5, =1.0.0, =1.2.3,...

co.paralleluniverse:comsat-spring-boot (0.3.0), co.paralleluniverse:comsat-spring-webmvc (0.3.0) +156 more potentially affected by CVE-2022-22968 via org.springframework:spring-context (4.0.8.release)

org.springframework:spring-context MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - co.paralleluniverse:comsat-spring-boot 0.3.0 -...

ai.foremast.metrics:foremast-spring-4x-k8s-metrics (>=0.1.6, <=0.2.0), capital.scalable:spring-auto-restdocs-core (>=1.0.14, <=1.0.15) +369 more potentially affected by CVE-2022-22968 via org.springframework:spring-context (4.3.15.release)

org.springframework:spring-context MAVEN version 4.3.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - ai.foremast.metrics:foremast-spring-4x-k8s-metrics =0.1.6, =1.0.14, =1.0.20, =1.0....

com.github.inspektr:inspektr-support-spring (1.0.0.ga), fr.figarocms:web-debug-tag (>=0.0.1, <=1.0) +55 more potentially affected by CVE-2022-22968 via org.springframework:spring-context (3.0.1.release)

org.springframework:spring-context MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - com.github.inspektr:inspektr-support-spring 1.0.0.ga - fr.figarocms:web-debug-tag...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +364 more potentially affected by CVE-2022-22968 via org.springframework:spring-context (4.3.1.release)

org.springframework:spring-context MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =2.0, =2.1.0-release,...