CVE-2022-22965

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 99,6%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada vmware spring framework, cisco cx cloud agent +25 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 4 April 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Rincian

Terbit di NVD

1 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

99,6% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Spring Framework JDK 9+ Remote Code Execution Vulnerability

Masuk KEV

4 April 2022

Tenggat CISA

25 April 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 89 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://tanzu.vmware.com/security/cve-2022-22965 mitigasi · advisory vendor
• https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
• https://www.kb.cert.org/vuls/id/970766 pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965 pemerintah AS
• http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution... advisory pihak ketiga · vdb entry
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005 advisory pihak ketiga
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67 advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuapr2022.html advisory pihak ketiga