Описание
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needs-triage |
| devel | released | 4.3.30-2ubuntu1 |
| esm-apps/bionic | released | 4.3.22-1~18.04.1~esm1 |
| esm-apps/focal | released | 4.3.22-4ubuntu0.1~esm1 |
| esm-apps/jammy | released | 4.3.30-1ubuntu0.1~esm1 |
| esm-apps/noble | released | 4.3.30-2ubuntu0.24.04.1~esm1 |
| esm-apps/xenial | not-affected | only builds using jdk 9+ are affected |
| esm-infra-legacy/trusty | not-affected | only builds using jdk 9+ are affected |
| focal | ignored | end of standard support, was needed |
| impish | ignored | end of life |
Показывать по
Ссылки на источники
EPSS
7.5 High
CVSS2
9.8 Critical
CVSS3
Связанные уязвимости
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vu ...
Уязвимость модуля Spring Core программной платформы Spring Framework, позволяющая нарушителю выполнить произвольный код
EPSS
7.5 High
CVSS2
9.8 Critical
CVSS3