Exploited
critical
9.8
CWE
94 74
Advisory Published
CVE Published
Updated

CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability

First published: Thu Mar 31 2022(Updated: )

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Credit: security@vmware.com security@vmware.com

Affected SoftwareAffected VersionHow to fix
debian/libspring-java<=4.3.30-1<=4.3.30-2
Spring Framework
maven/org.springframework:spring-webflux<5.2.20.RELEASE
5.2.20.RELEASE
maven/org.springframework:spring-webmvc<5.2.20.RELEASE
5.2.20.RELEASE
maven/org.springframework:spring-beans<5.2.20.RELEASE
5.2.20.RELEASE
maven/org.springframework.boot:spring-boot-starter-webflux>=2.6.0<2.6.6
2.6.6
maven/org.springframework.boot:spring-boot-starter-webflux<2.5.12
2.5.12
maven/org.springframework:spring-webflux>=5.3.0<5.3.18
5.3.18
maven/org.springframework.boot:spring-boot-starter-web>=2.6.0<2.6.6
2.6.6
maven/org.springframework.boot:spring-boot-starter-web<2.5.12
2.5.12
maven/org.springframework:spring-webmvc>=5.3.0<5.3.18
5.3.18
maven/org.springframework:spring-beans>=5.3.0<5.3.18
5.3.18
All of
Any of
Spring Framework<5.2.20
Spring Framework>=5.3.0<5.3.18
Oracle JDK 6>=9
Cisco CX Cloud Agent<2.1.0
Oracle Communications Cloud Native Core Automated Test Suite=1.9.0
Oracle Communications Cloud Native Core Automated Test Suite=22.1.0
oracle communications cloud native core console=1.9.0
oracle communications cloud native core console=22.1.0
oracle communications cloud native core network exposure function=22.1.0
oracle communications cloud native core network function cloud native environment=1.10.0
oracle communications cloud native core network function cloud native environment=22.1.0
Oracle Communications Cloud Native Core Network Repository Function=1.15.0
Oracle Communications Cloud Native Core Network Repository Function=22.1.0
Oracle Communications Cloud Native Core Network Slice Selection Function=1.8.0
Oracle Communications Cloud Native Core Network Slice Selection Function=1.15.0
Oracle Communications Cloud Native Core Network Slice Selection Function=22.1.0
oracle communications Cloud native core policy=1.15.0
oracle communications Cloud native core policy=22.1.0
Oracle Communications Cloud Native Core Network Repository Function=1.7.0
Oracle Communications Cloud Native Core Network Repository Function=22.1.0
Oracle Communications Cloud Native Core Unified Data Repository=1.15.0
Oracle Communications Cloud Native Core Unified Data Repository=22.1.0
Oracle Communications Policy Management=12.6.0.0.0
Oracle Financial Services Analytical Applications Infrastructure=8.1.1
Oracle Financial Services Analytical Applications Infrastructure=8.1.2.0
Oracle Financial Services Behavior Detection Platform=8.1.1.0
Oracle Financial Services Behavior Detection Platform=8.1.1.1
Oracle Financial Services Behavior Detection Platform=8.1.2.0
Oracle Financial Services Enterprise Case Management=8.1.1.0
Oracle Financial Services Enterprise Case Management=8.1.1.1
Oracle Financial Services Enterprise Case Management=8.1.2.0
MySQL Enterprise Monitor<8.0.29
oracle product lifecycle analytics=3.6.1
Oracle Retail Xstore Office Cloud Service=20.0.1
Oracle Retail Xstore Office Cloud Service=21.0.0
Oracle SD-WAN Edge=9.0
Oracle SD-WAN Edge=9.1
siemens operation scheduler<2.0.4
Siemens SiPass integrated=2.80
Siemens SiPass integrated=2.85
siemens siveillance identity=1.5
siemens siveillance identity=1.6
Veritas Access Appliance=7.4.3
Veritas Access Appliance=7.4.3.100
Veritas Access Appliance=7.4.3.200
Veritas Flex Appliance=1.3
Veritas Flex Appliance=2.0
Veritas Flex Appliance=2.0.1
Veritas Flex Appliance=2.0.2
Veritas Flex Appliance=2.1
Veritas NetBackup Flex Scale Appliance=2.1
Veritas NetBackup Flex Scale Appliance=3.0
Veritas NetBackup Appliance=4.0
Veritas NetBackup Appliance=4.0.0.1-maintenance_release1
Veritas NetBackup Appliance=4.0.0.1-maintenance_release2
Veritas NetBackup Appliance=4.0.0.1-maintenance_release3
Veritas NetBackup Appliance=4.1
Veritas NetBackup Appliance=4.1.0.1-maintenance_release1
Veritas NetBackup Appliance=4.1.0.1-maintenance_release2
Veritas NetBackup Virtual Appliance=4.0
Veritas NetBackup Virtual Appliance=4.0.0.1-maintenance_release1
Veritas NetBackup Virtual Appliance=4.0.0.1-maintenance_release2
Veritas NetBackup Virtual Appliance=4.0.0.1-maintenance_release3
Veritas NetBackup Virtual Appliance=4.1
Veritas NetBackup Virtual Appliance=4.1.0.1-maintenance_release1
Veritas NetBackup Virtual Appliance=4.1.0.1-maintenance_release2
siemens simatic speech assistant for machines<1.2.1
Siemens SINEC NMS<1.0.3
Oracle Commerce Platform=11.3.2
oracle communications Cloud native core binding support function=22.1.3
Oracle Communications Unified Inventory Management=7.4.1
Oracle Communications Unified Inventory Management=7.4.2
Oracle Communications Unified Inventory Management=7.5.0
Oracle Retail Bulk Data Integration=16.0.3
Oracle Customer Management and Segmentation Foundation=17.0
Oracle Customer Management and Segmentation Foundation=18.0
Oracle Customer Management and Segmentation Foundation=19.0
oracle retail financial integration=14.1.3.2
oracle retail financial integration=15.0.3.1
oracle retail financial integration=16.0.3
oracle retail financial integration=19.0.1
Oracle Retail Integration Bus=14.1.3.2
Oracle Retail Integration Bus=15.0.3.1
Oracle Retail Integration Bus=16.0.3
Oracle Retail Integration Bus=19.0.1
Oracle Retail Merchandising System=16.0.3
Oracle Retail Merchandising System=19.0.1
Oracle WebLogic Server=12.2.1.3.0
Oracle WebLogic Server=12.2.1.4.0
Oracle WebLogic Server=14.1.1.0.0
Spring Framework<5.2.20
Spring Framework>=5.3.0<5.3.18

Remedy

https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf

Remedy

https://www.oracle.com/security-alerts/cpujul2022.html

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2022-22965?

    CVE-2022-22965 has been assigned a severity rating that indicates a high risk of remote code execution in affected Spring MVC or Spring WebFlux applications.

  • How do I fix CVE-2022-22965?

    To mitigate CVE-2022-22965, update your Spring Framework to version 5.2.20.RELEASE or later, or ensure you are using Spring Boot 2.5.12 or later.

  • Which applications are affected by CVE-2022-22965?

    CVE-2022-22965 affects Spring MVC or Spring WebFlux applications running on JDK 9+ deployed as WAR files on Tomcat.

  • Is CVE-2022-22965 exploitable if using Spring Boot executable jar?

    No, CVE-2022-22965 is specifically exploitable only in Spring MVC or Spring WebFlux applications deployed as WAR files on Tomcat.

  • What versions of Spring Framework are vulnerable to CVE-2022-22965?

    Versions of Spring Framework prior to 5.2.20.RELEASE and from 5.3.0 up to 5.3.18 are considered vulnerable to CVE-2022-22965.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203