CVE-2022-22965 — CVE & Security Advisory Radar

🎯 CVE-2022-22965 CRITICAL 9.8 🔥 EPSS 99.7% ⚠️ CISA KEV · 1616 T 🔓 Exploited 🧪 PoC 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2022-22965 | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Klassifikation & Betroffenheit:

n/a Spring Framework Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versionsvmware spring_framework *oracle jdk *cisco cx_cloud_agent *oracle communications_cloud_native_core_automated_test_suite 1.9.0oracle communications_cloud_native_core_automated_test_suite 22.1.0oracle communications_cloud_native_core_console 1.9.0oracle communications_cloud_native_core_console 22.1.0

Improper Control of Generation of Code ('Code Injection') 🎯 Medium

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

🛡️ Empfohlene Mitigation: Refactor your program so that you do not have to dynamically generate code.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-35 · Leverage Executable Code in Non-Executab… (Very High) CAPEC-77 · Manipulating User-Controlled Variables (Very High) CAPEC-242 · Code Injection (High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1027.006 · Obfuscated Files or Information: H… T1027.009 · Obfuscated Files or Information: E… T1564.009 · Hide Artifacts: Resource Forking

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-37541 10.0 CVE-2026-36767 10.0 CVE-2025-54328 10.0 CVE-2026-30302 10.0 CVE-2025-69770 10.0

🧪 Exploit-Evidenz:

🐙 BobTheShoplifter/Spring4Shell-PO 🐙 Mr-xn/spring-core-rce 🐙 TheGejr/SpringShell 🐙 reznok/Spring4Shell-POC 🐙 Bouquets-ai/CVE-2022-22965-GUIto

🩹 Patch verfügbar (OSV):

🩹 cfa701b8726f06528e9d408b1b94f333f70da45f (Commit) 🩹 707a24c48b21fc35e8be715afc80f020a24a9714 (Commit)

📰 Eigene Berichterstattung: ➔ Elastic's response to the Spring4Shell vulnerability (CVE-2022-22965) ➔ Elastic's response to the Spring4Shell vulnerability (CVE-2022-22965) ➔ Elastic's response to the Spring4Shell vulnerability (CVE-2022-22965) ➔ Elastic's response to the Spring4Shell vulnerability (CVE-2022-22965) ➔ Elastic's response to the Spring4Shell vulnerability (CVE-2022-22965)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2022

Veröffentlicht 04/2022

Im KEV seit 04/2022

Heute 06.09.

CVSS-Vektor-Analyse: 9.8

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Veröffentlicht:01.04.2022

Aktualisiert:17.06.2026 04:29

Assigner (CNA):vmware

EUVD-ID:EUVD-2022-1283

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	2026-08-29	2026-09-05
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

9.8 CRITICAL

🇪🇺 EUVD ⚠️ KEV

EPSS

99.7%

CVE-2022-22965 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

🔓 🧪 n/a

CVE-2022-22965 | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

01.04.2022

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub