cyfenced.com →

[ CVE-2022-22965 · Published 1 Apr 2022 ]

Spring Framework JDK 9+ Remote Code Execution Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 100%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-04-04
  • EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

CISA: Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 25 Apr 2022): Apply updates per vendor instructions.

[ References ]References