CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24) +1215 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-webflux (>=2.0.0.release, <=2.5.11)

org.springframework.boot:spring-boot-starter-webflux MAVEN version =2.0.0.release, =1.0.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =2.1.2.release, =1.3, =0.5.0, =3.1.37, =3.1.13, =3.1.85, =3.1.13, =3.1.13, =3.1.295 - ch.mobi.mobitor:mobitor-doc 3.1.13 and more Source cves: CVE-2022-22965 Source...

Remote Code Execution in Spring Framework

Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as Spring4Shell. Impact A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24) +1215 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-webflux (>=2.0.0.release, <=2.5.11)

org.springframework.boot:spring-boot-starter-webflux MAVEN version =2.0.0.release, =1.0.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =2.1.2.release, =1.3, =0.5.0, =3.1.37, =3.1.13, =3.1.85, =3.1.13, =3.1.13, =3.1.295 - ch.mobi.mobitor:mobitor-doc 3.1.13 and more Source cves: CVE-2022-22965 Source...

ai.ylyue:yue-library-webflux (j11.2.6.0), ca.gc.cyber.ops:assemblyline-java-client (>=1.7, <=1.8) +335 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-webflux (>=2.6.0, <=2.6.5)

org.springframework.boot:spring-boot-starter-webflux MAVEN version =2.6.0, =1.7, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =0.2.2, =1.1.3, =1.1.3, =3.12.0, =1.4.6, =0.1.0, =1.2.0 and more Source cves: CVE-2022-22965 Source advisory: OSV:GHSA-36P3-WJMG-H94X...

br.com.ideotech:draw-out-spring-boot-aop (>=1.5.19.release, <=1.5.19-4.release), br.com.ideotech:draw-out-spring-boot-lib (>=1.5.19.release, <=1.5.19-4.release) +70 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.5.19.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.5.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - br.com.ideotech:draw-out-spring-boot-aop...

cn.skylarkai:license (>=1.0.0, <=1.0.2), com.eworkcloud:ework-cloud-starter-web (>=1.0.0, <=1.8.1) +50 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.5.20.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.5.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - cn.skylarkai:license =1.0.0, =1.0.0, =1.0,...

cn.ttpai.framework:ttpai-rose-spring-boot-starter (1.0.2), com.alibaba.cloud:spring-cloud-alibaba-sentinel-gateway (1.5.1.release) +99 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.5.21.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.5.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - cn.ttpai.framework:ttpai-rose-spring-boot-starter 1.0....

cn.com.365trade.oss:xxl-job-admin (>=2.2.1_zzlh, <=2.2.1.1_zzlh), cn.springcloud.gray:spring-cloud-gray-plugin-event-stream (>=a.1.1.1, <=a.2.0.0) +102 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.5.22.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.5.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - cn.com.365trade.oss:xxl-job-admin =2.2.1zzlh, =a.1.1.1...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +10342 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (>=2.0.0.release, <=2.5.11)

org.springframework.boot:spring-boot-starter-web MAVEN version =2.0.0.release, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =finchley.sr2.sr1, =finchley.sr4, =greenwich.sr2.1 and more Source cves: CVE-2022-22965 Source advisory:...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.ylyue:yue-library-auth-client (j11.2.6.0) +1765 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (>=2.6.0, <=2.6.5)

org.springframework.boot:spring-boot-starter-web MAVEN version =2.6.0, =4.4.0.2, =1.2.5.release, =0.1.2, =5.7.7, =5.7.7, =5.7.7, =1.0.0, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.313 and more Source cves: CVE-2022-22965 Source advisory: OSV:GHSA-36P3-WJMG-H94X...

club.zhcs:axe-swagger (>=1.5.13, <=1.5.13.2), club.zhcs:axe-validation (>=1.5.13, <=1.5.13.2) +368 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.5.13.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.5.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - club.zhcs:axe-swagger =1.5.13, =1.5.13, =0.0.7.release...

com.arcadeanalytics:arcadeanalytics (>=1.0.2, <=1.0.8), com.deere.isg.work-tracker.examples:spring-boot-example (>=1.0.0-rc4, <=1.0.0-rc14) +37 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.5.15.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.5.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - com.arcadeanalytics:arcadeanalytics =1.0.2, =1.0.0-rc4...

club.zhcs:axe-swagger (>=1.5.14, <=1.5.14.1), club.zhcs:axe-validation (>=1.5.14, <=1.5.14.1) +441 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.5.14.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.5.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - club.zhcs:axe-swagger =1.5.14, =1.5.14, =2.19.10.0,...

com.alibaba.cloud:spring-cloud-alibaba-sentinel-gateway (1.5.0.release), com.alibaba.cloud:spring-cloud-starter-bus-rocketmq (1.5.0.release) +166 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.5.16.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.5.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - com.alibaba.cloud:spring-cloud-alibaba-sentinel-gatewa...

com.github.g-chenning:jdbc-yml-quick (0.0.6-release), com.github.g-chenning:jdbc-yml-quick-opensource-wcn (0.0.1.release) +40 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.5.17.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.5.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - com.github.g-chenning:jdbc-yml-quick 0.0.6-release -...

com.foreach.imageserver:imageserver-test-embedded (5.0.0.release), com.github.waffle.demo:waffle-spring-boot-filter (2.0.0-beta1) +102 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.5.18.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.5.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - com.foreach.imageserver:imageserver-test-embedded...

biz.jovido:jovido-webseed (>=0.0.1, <=0.0.1-fenicesfa), biz.jovido:jovido-webseed-fenicesfa (0.0.1) +385 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.5.4.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.5.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - biz.jovido:jovido-webseed =0.0.1, =1.0.1, =0.0.1.releas...

club.zhcs:axe-swagger (>=1.2, <=1.5), club.zhcs:axe-validation (>=1.2, <=1.5) +467 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.5.6.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.5.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - club.zhcs:axe-swagger =1.2, =1.2, =0.1.1, =0.19.0,...

cc.catalysts.boot:cat-boot-thymeleaf (>=0.2.13, <=0.2.28), cn.izern:spring-boot-autoconfigure (1.0) +436 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.5.7.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.5.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - cc.catalysts.boot:cat-boot-thymeleaf =0.2.13, =1.0.0,...