Vulnerability in Spring Framework Affecting Cisco Products: March 2022

On March 31, 2022, the following critical vulnerability in the Spring Framework affecting Spring MVC and Spring WebFlux applications running on JDK 9+ was released: CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+ For a description of this vulnerability, see VMware Spring Framework...

DEBIAN-CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

Remote code execution

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24), ai.hyacinth.framework:core-service-gateway-server (>=0.5.0, <=0.5.24) +1272 more potentially affected by CVE-2022-22965 via org.springframework:spring-webflux (>=5.0.0.release, <=5.2.19.release)

org.springframework:spring-webflux MAVEN version =5.0.0.release, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =0.0.1, =2.1.2.release, =4.2.7, =4.1.7, =2.0.2, =0.5.0, =3.1.64, =3.1.37, =3.1.13, =3.1.64, =3.1.64, =3.1.237 and more Source cves: CVE-2022-22965 Source advisory: MEND:CVE-2022-22965...

CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

CVE-2022-22965

CVE-2022-22965 (Spring4Shell) affects Spring Framework’s Spring MVC and Spring WebFlux when data binding is enabled in apps running on JDK 9+, with exploitation requiring Tomcat as WAR deployment. The issue is not exploited in Spring Boot executable jars. Vulnerable configurations are associated ...

CVE-2022-22965: Improper Control of Generation of Code

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

Spring Core Remote Code Execution via Data Binding on JDK 9+

A remote code execution RCE vulnerability was discovered in the Spring framework, affecting at least Spring versions 4.x and 5.x. A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the...

ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24), ai.hyacinth.framework:core-service-gateway-server (>=0.5.0, <=0.5.24) +1272 more potentially affected by CVE-2022-22965 via org.springframework:spring-webflux (>=5.0.0.release, <=5.2.19.release)

org.springframework:spring-webflux MAVEN version =5.0.0.release, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =0.0.1, =2.1.2.release, =4.2.7, =4.1.7, =2.0.2, =0.5.0, =3.1.64, =3.1.37, =3.1.13, =3.1.64, =3.1.64, =3.1.237 and more Source cves: CVE-2022-22965 Source advisory: OSV:GHSA-36P3-WJMG-H94X...

africa.absa:inception-application (>=1.0.0, <=1.2.0), africa.absa:inception-test (>=1.0.0, <=1.2.0) +997 more potentially affected by CVE-2022-22965 via org.springframework:spring-webflux (>=5.3.0, <=5.3.17)

org.springframework:spring-webflux MAVEN version =5.3.0, =1.0.0, =1.0.0, =j8.2.4.0, =4.1.27, =4.3.0-beta.1, =1.3, =1.0.4.r, =0.0.0, =3.1.242, =3.1.242, =3.1.242, =3.1.242, =3.1.242, =3.1.242, =3.1.313 and more Source cves: CVE-2022-22965 Source advisory: OSV:GHSA-36P3-WJMG-H94X...

GHSA-36P3-WJMG-H94X Remote Code Execution in Spring Framework

Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as Spring4Shell. Impact A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the...

ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24), ai.hyacinth.framework:core-service-gateway-server (>=0.5.0, <=0.5.24) +1272 more potentially affected by CVE-2022-22965 via org.springframework:spring-webflux (>=5.0.0.release, <=5.2.19.release)

org.springframework:spring-webflux MAVEN version =5.0.0.release, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =0.0.1, =2.1.2.release, =4.2.7, =4.1.7, =2.0.2, =0.5.0, =3.1.64, =3.1.37, =3.1.13, =3.1.64, =3.1.64, =3.1.237 and more Source cves: CVE-2022-22965 Source advisory: GHSA-36P3-WJMG-H94X...

Remote Code Execution in Spring Framework

Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as Spring4Shell. Impact A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the...

Exploit for Code Injection in Vmware Spring_Framework

CVE-2022-22965 aka "Spring4Shell" Vulnerabilidad RCE en Spri...

Spring Framework Zero-Day Remote Code Execution (Spring4Shell) Vulnerability

This page last updated: April 7th A new zero-day Remote Code Execution RCE vulnerability, “Spring4Shell” or “SpringShell” was disclosed in the Spring framework. An unauthorized attacker can exploit this vulnerability to remotely execute arbitrary code on the target device. What is Spring Framewor...

Spring4Shell: Zero-Day Vulnerability in Spring Framework (CVE-2022-22965)

Rapid7 has completed remediating the instances of Spring4Shell CVE-2022-22965 and Spring Cloud CVE-2022-22963 vulnerabilities that we found on our internet-facing services and systems. For further information and updates about our internal response to Spring4Shell, please see our post here. If yo...