CVE-2022-22965
Summary
| CVE | CVE-2022-22965 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-04-01 23:15:00 UTC |
| Updated | 2023-02-09 02:07:00 UTC |
| Description | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. |
Risk And Classification
EPSS: 0.944280000 probability, percentile 0.999830000 (date 2026-04-01)
CISA KEV: Listed on 2022-04-04; due 2022-04-25; ransomware use Unknown
Problem Types: CWE-94
CISA Known Exploited Vulnerability
| Vendor | VMware |
|---|---|
| Product | Spring Framework |
| Name | Spring Framework JDK 9+ Remote Code Execution Vulnerability |
| Required Action | Apply updates per vendor instructions. |
| Notes | https://nvd.nist.gov/vuln/detail/CVE-2022-22965 |
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+ | Security | VMware Tanzu | MISC | tanzu.vmware.com | |
| Spring4Shell Code Execution ≈ Packet Storm | MISC | packetstormsecurity.com | |
| Oracle Critical Patch Update Advisory - April 2022 | MISC | www.oracle.com | |
| cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf | CONFIRM | cert-portal.siemens.com | |
| 20220401 Vulnerability in Spring Framework Affecting Cisco Products: March 2022 | CISCO | tools.cisco.com | |
| Spring4Shell Spring Framework Class Property Remote Code Execution ≈ Packet Storm | MISC | packetstormsecurity.com | |
| Security Advisory | CONFIRM | psirt.global.sonicwall.com | |
| Oracle Critical Patch Update Advisory - July 2022 | N/A | www.oracle.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 150494 Spring Core Remote Code Execution (RCE) Vulnerability (Spring4Shell)
- 150495 Spring Core Remote Code Execution (RCE) Vulnerability CVE-2022-22965 (Spring4Shell)
- 356282 Amazon Linux Security Advisory for tomcat : ALASTOMCAT9-2023-004
- 356303 Amazon Linux Security Advisory for tomcat : ALASTOMCAT8.5-2023-005
- 376506 Spring Framework Remote Code Execution (RCE) Vulnerability (Spring4Shell)
- 376514 Spring Framework Remote Code Execution (RCE) Vulnerability (Spring4Shell) Scan Utility
- 591277 Siemens SINEC NMS Remote Code Execution (RCE) Vulnerability (SSA-254054)
- 730416 Spring Core Remote Code Execution (RCE) Vulnerability (Spring4Shell) (Unauthenticated Check)
- 730482 Atlassian Jira Spring Framework Remote Code Execution (RCE) Vulnerability (JRASERVER-73773)
- 730516 Atlassian Confluence Server and Confluence Data Center Remote Code Execution (RCE) Vulnerability (CONFSERVER-78586)
- 87490 Cisco Data Center Network Manager Spring4Shell Vulnerability (CSCwb43637)
- 984158 Java (maven) Security Update for org.springframework.boot:spring-boot-starter-webflux (GHSA-36p3-wjmg-h94x)