vmware spring-framework CVE-2022-22965 vulnerability in VMware and Other Products
Published on April 1, 2022

product logo product logo product logo product logo product logo
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Vendor Advisory NVD

Known Exploited Vulnerability

This Spring Framework JDK 9+ Remote Code Execution Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

The following remediation steps are recommended / required by April 25, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2022-22965 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

What is a Code Injection Vulnerability?

The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CVE-2022-22965 has been classified to as a Code Injection vulnerability or weakness.


Products Associated with CVE-2022-22965

You can be notified by stack.watch whenever vulnerabilities like CVE-2022-22965 are published in these products:

VMware Spring Framework
 
Cisco Cx Cloud Agent
 
Oracle Communications Cloud Native Core Automated Test Suite
 
Oracle Communications Cloud Native Core Console
 
Oracle Communications Cloud Native Core Network Exposure Function
 
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
 
Oracle Communications Cloud Native Core Network Repository Function
 
Oracle Communications Cloud Native Core Network Slice Selection Function
 
Oracle Communications Cloud Native Core Policy
 
Oracle Communications Cloud Native Core Security Edge Protection Proxy
 
Oracle Communications Cloud Native Core Unified Data Repository
 
Oracle Communications Policy Management
 
Oracle Financial Services Analytical Applications Infrastructure
 
Oracle Financial Services Behavior Detection Platform
 
Oracle Financial Services Enterprise Case Management
 
Oracle Mysql Enterprise Monitor
 
Oracle Product Lifecycle Analytics
 
Oracle Retail Xstore Point Of Service
 
Oracle Sd Wan Edge
 
Siemens Operation Scheduler
 
Siemens Sipass Integrated
 
Siemens Siveillance Identity
 
Veritas Access Appliance
 
Veritas Netbackup Virtual Appliance
 
Veritas Netbackup Appliance
 
Veritas Netbackup Flex Scale Appliance
 
Veritas Flex Appliance
 
Siemens Sinec Network Management System
 
Siemens Simatic Speech Assistant Machines
 
Oracle Weblogic Server
 
Oracle Retail Customer Management Segmentation Foundation
 
Oracle Retail Merchandising System
 
Oracle Retail Financial Integration
 
Oracle Retail Integration Bus
 
Oracle Communications Unified Inventory Management
 
Oracle Commerce Platform
 
Oracle Retail Bulk Data Integration
 
Oracle Communications Cloud Native Core Binding Support Function
 

What versions are vulnerable to CVE-2022-22965?