Advisory details:
vulnrichment / CVE-2022-22965
| Advisory ID | vulnrichment/CVE-2022-22965 |
| Aliases | |
| Summary | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 9.8 | |
| ssvc | Act |
| Reference id | Reference type | URL |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf | ||
| https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005 | ||
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67 | ||
| cpuapr2022.html | Other | https://www.oracle.com/security-alerts/cpuapr2022.html |
| cpujul2022.html | Other | https://www.oracle.com/security-alerts/cpujul2022.html |
| CVE-2022-22965 | https://tanzu.vmware.com/security/cve-2022-22965 | |
| Spring4Shell-Code-Execution.html | Other | http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html |
| Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html | Other | http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html |
| Data source | Metasploit |
|---|---|
| Description | Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions when running on JDK 9 or above and specifically packaged as a traditional WAR and deployed in a standalone Tomcat instance are vulnerable to remote code execution due to an unsafe data binding used to populate an object from request parameters to set a Tomcat specific ClassLoader. By crafting a request to the application and referencing the org.apache.catalina.valves.AccessLogValve class through the classLoader with parameters such as the following: class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp, an unauthenticated attacker can gain remote code execution. |
| Note | AKA: - Spring4Shell - SpringShell Stability: - crash-safe Reliability: - repeatable-session SideEffects: - ioc-in-logs - artifacts-on-disk |
| Ransomware campaign use | Unknown |
| Source publication date | March 31, 2022 |
| Platform | Linux,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/spring_framework_rce_spring4shell.rb |
| Data source | KEV |
|---|---|
| Date added | April 4, 2022 |
| Description | Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. |
| Required action | Apply updates per vendor instructions. |
| Due date | April 25, 2022 |
| Note | https://nvd.nist.gov/vuln/detail/CVE-2022-22965 |
| Ransomware campaign use | Unknown |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
Decision: Act
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2022/22xxx/CVE-2022-22965.json
Source Advisory: vulnrichment/CVE-2022-22965
[{'Exploitation': 'active'},
{'Automatable': 'yes'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]