CVE-2022-22965

Опубликовано: 01 апр. 2022

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Критический

Описание

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Ссылки

http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
Third Party Advisory
VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
Patch
Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
Third Party Advisory
https://tanzu.vmware.com/security/cve-2022-22965
Mitigation
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory
http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
Third Party Advisory
VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
Patch
Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
Third Party Advisory
https://tanzu.vmware.com/security/cve-2022-22965
Mitigation
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
Third Party Advisory
https://www.kb.cert.org/vuls/id/970766
US Government Resource
https://www.oracle.com/security-alerts/cpuapr2022.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*

Версия до 5.2.20 (исключая)

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*

Версия от 5.3.0 (включая) до 5.3.18 (исключая)

cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*

Версия от 9 (включая)

Конфигурация 2

cpe:2.3:a:cisco:cx_cloud_agent:*:*:*:*:*:*:*:*

Версия до 2.1.0 (исключая)

Конфигурация 3

Одно из

cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:22.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_console:22.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*

Версия до 8.0.29 (исключая)

cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*

cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*

Версия до 2.0.4 (исключая)

cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*

cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*

cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*

cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:veritas:access_appliance:7.4.3:*:*:*:*:*:*:*

cpe:2.3:a:veritas:access_appliance:7.4.3.100:*:*:*:*:*:*:*

cpe:2.3:a:veritas:access_appliance:7.4.3.200:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:a:veritas:access_appliance:7.4.3:*:*:*:*:*:*:*

cpe:2.3:a:veritas:access_appliance:7.4.3.100:*:*:*:*:*:*:*

cpe:2.3:a:veritas:access_appliance:7.4.3.200:*:*:*:*:*:*:*

cpe:2.3:a:veritas:flex_appliance:1.3:*:*:*:*:*:*:*

cpe:2.3:a:veritas:flex_appliance:2.0:*:*:*:*:*:*:*

cpe:2.3:a:veritas:flex_appliance:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:veritas:flex_appliance:2.0.2:*:*:*:*:*:*:*

cpe:2.3:a:veritas:flex_appliance:2.1:*:*:*:*:*:*:*

cpe:2.3:a:veritas:netbackup_flex_scale_appliance:2.1:*:*:*:*:*:*:*

cpe:2.3:a:veritas:netbackup_flex_scale_appliance:3.0:*:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_appliance:4.0:*:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release1:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release2:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release3:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_appliance:4.1:*:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_appliance:4.1.0.1:maintenance_release1:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_appliance:4.1.0.1:maintenance_release2:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0:*:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release1:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release2:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release3:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1:*:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1.0.1:maintenance_release1:*:*:*:*:*:*

cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1.0.1:maintenance_release2:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*

Версия до 2.0.4 (исключая)

cpe:2.3:a:siemens:simatic_speech_assistant_for_machines:*:*:*:*:*:*:*:*

Версия до 1.2.1 (исключая)

cpe:2.3:a:siemens:sinec_network_management_system:*:*:*:*:*:*:*:*

Версия до 1.0.3 (исключая)

cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*

cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*

cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*

cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*

Конфигурация 7

Одно из

cpe:2.3:a:oracle:commerce_platform:11.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:15.0.3.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:19.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.9446

Критический

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-94

Связанные уязвимости

CVE-2022-22965

CVSS3: 9.8

ubuntu

около 3 лет назад

CVE-2022-22965

CVSS3: 8.1

redhat

около 3 лет назад

CVE-2022-22965

CVSS3: 9.8

debian

около 3 лет назад

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vu ...

GHSA-36p3-wjmg-h94x

CVSS3: 9.8

github

около 3 лет назад

Remote Code Execution in Spring Framework

BDU:2022-01631

CVSS3: 8.8

fstec

около 3 лет назад

Уязвимость модуля Spring Core программной платформы Spring Framework, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 100%

0.9446

Критический

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-94