CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution, actively exploited

Description

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Cisco Cx Cloud Agent< 2.1.0

Oracle Commerce Platform11.3.2

Oracle Communications Cloud Native Core Automated Test Suite1.9.0 · 22.1.0

Oracle Communications Cloud Native Core Binding Support Function22.1.3

Oracle Communications Cloud Native Core Console1.9.0 · 22.1.0

Oracle Communications Cloud Native Core Network Exposure Function22.1.0

Oracle Communications Cloud Native Core Network Function Cloud Native Environment1.10.0 · 22.1.0

Oracle Communications Cloud Native Core Network Repository Function1.15.0 · 22.1.0

Oracle Communications Cloud Native Core Network Slice Selection Function1.15.0 · 1.8.0 · 22.1.0

Oracle Communications Cloud Native Core Policy1.15.0 · 22.1.0

Oracle Communications Cloud Native Core Security Edge Protection Proxy1.7.0 · 22.1.0

Oracle Communications Cloud Native Core Unified Data Repository1.15.0 · 22.1.0

Oracle Communications Policy Management12.6.0.0.0

Oracle Communications Unified Inventory Management7.4.1 · 7.4.2 · 7.5.0

Oracle Financial Services Analytical Applications Infrastructure8.1.1 · 8.1.2.0

Oracle Financial Services Behavior Detection Platform8.1.1.0 · 8.1.1.1 · 8.1.2.0

Oracle Financial Services Enterprise Case Management8.1.1.0 · 8.1.1.1 · 8.1.2.0

Oracle Mysql Enterprise Monitor< 8.0.29

Oracle Product Lifecycle Analytics3.6.1

Oracle Retail Bulk Data Integration16.0.3

Oracle Retail Customer Management And Segmentation Foundation17.0 · 18.0 · 19.0

Oracle Retail Financial Integration14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1

Oracle Retail Integration Bus14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1

Oracle Retail Merchandising System16.0.3 · 19.0.1

Remediation

Fixed in

Cisco Cx Cloud Agent≥ 2.1.0

Oracle Mysql Enterprise Monitor≥ 8.0.29

Siemens Operation Scheduler≥ 2.0.4

Siemens Simatic Speech Assistant For Machines≥ 1.2.1

Siemens Sinec Network Management System≥ 1.0.3

VMware Spring Framework≥ 5.3.18

Patch & vendor advisories

References

http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.htmlThird Party AdvisoryVDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdfPatchThird Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005Third Party Advisory
https://tanzu.vmware.com/security/cve-2022-22965MitigationVendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965US Government Resource
https://www.kb.cert.org/vuls/id/970766US Government Resource
https://www.oracle.com/security-alerts/cpuapr2022.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatchThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2022-22965 being actively exploited?

Yes. CVE-2022-22965 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 4 Apr 2022.

How severe is CVE-2022-22965?

CVE-2022-22965 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 99.6% probability of exploitation.

Which products are affected by CVE-2022-22965?

Affected products include Cisco Cx Cloud Agent, Oracle Commerce Platform, Oracle Communications Cloud Native Core Automated Test Suite, Oracle Communications Cloud Native Core Binding Support Function, Oracle Communications Cloud Native Core Console, and 19 more.

How do I fix CVE-2022-22965?

Upgrade affected software to a fixed version, for example Cisco Cx Cloud Agent 2.1.0, Oracle Mysql Enterprise Monitor 8.0.29, Siemens Operation Scheduler 2.0.4 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2022-22965 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo