CVE-2022-22965
highPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEPSS 0.996 · 100. PerzentilExploit · PoCDEEURUUShinzugefügt 2022-04-04beheben bis 2022-04-25
erforderliche Maßnahme Apply updates per vendor instructions.
EPSS · bewertet 2026-10-27
Spring Framework JDK 9+ Remote Code Execution Vulnerability
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenOperation Schedulersiemens_psirt
Update to V2.0.4 or later version
- BehobenSIMATIC Speech Assistant for Machines (SAM)siemens_psirt
Update to V1.2.1 or later version. Please contact customer support to obtain the patch
- BehobenSINEC NMSsiemens_psirt
Update to V1.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109813788/ - BehobenSiPass integrated V2.80siemens_psirt
Apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109805711/ - BehobenSiPass integrated V2.85siemens_psirt
Apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109805711/ - BehobenSiveillance Identity V1.5siemens_psirt
Update to V1.5 SP4 and apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109810454/ - BehobenSiveillance Identity V1.6siemens_psirt
Update to V1.6 SP1 and apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109810454/ - BehobenCisco Emergency Respondercisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Evolved Programmable Network Manager (EPNM)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco HyperFlex HX Data Platformcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco IoT Field Network Director (IoT-FND)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Prime Collaboration Deploymentcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Prime License Managercisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Secure Firewall Management Center (FMC)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Secure Firewall Threat Defense (FTD) Softwarecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Unified Communications Managercisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Unified Communications Manager / Cisco Unity Connectioncisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Unified Communications Manager IM and Presence Servicecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Unity Connectioncisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - MitigationOperation Schedulersiemens_psirt
Block both incoming and outgoing connections between the system and the Internet
- MitigationSIMATIC Speech Assistant for Machines (SAM)siemens_psirt
Block both incoming and outgoing connections between the system and the Internet
- MitigationSINEC NMSsiemens_psirt
Block both incoming and outgoing connections between the system and the Internet
- MitigationSiPass integrated V2.80siemens_psirt
Block both incoming and outgoing connections between the system and the Internet
- MitigationSiPass integrated V2.85siemens_psirt
Block both incoming and outgoing connections between the system and the Internet
- MitigationSiveillance Identity V1.5siemens_psirt
Block both incoming and outgoing connections between the system and the Internet
- MitigationSiveillance Identity V1.6siemens_psirt
Block both incoming and outgoing connections between the system and the Internet
- MitigationLumada Asset Performance Manager (APM)cisa_csaf_ot
Disabling the Prognostic Model Executor service will cause the Lumada APM application to stop performing condition assessment calculations (for all assets configured to use prognostic models) and to accumulate calculation requests in the internal messaging queue. As the requests in the queue have a limited lifetime (set by messaging bus topic retention), when that lifetime expires, the request will be lost.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
ATT&CK-Techniken
ATT&CK-Techniken, die dies ermöglicht oder abbildet.
Exploits (100)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- 0xBlackash/CVE-2022-22965CVE-2022-22965PoC · poc_in_github
- 0xrobiul/CVE-2022-22965Exploit Of Spring4Shell!PoC · poc_in_github
- 4nth0ny1130/spring4shell_behinderCVE-2022-22965写入冰蝎webshell脚本PoC · poc_in_github
- BKLockly/CVE-2022-22965Poc&Exp,支持批量扫描,反弹shellPoC · poc_in_github
betroffene Produkte (142)
Betroffene Produkte und Versionsbereiche.
Advisories (12)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-254054SSA-254054: Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products2022-04-19csaf · siemens_psirtDE
A vulnerability in Spring Framework was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2022-22965 and is also known as "Spring4Shell" or "SpringShell". Siemens has released updates for the affected products and recommends to update to the latest versions.
- WID-SEC-W-2022-0033VMware Tanzu Spring Framework: Schwachstelle ermöglicht Ausführen von beliebigem ProgrammcodeDeutsch2022-03-30csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Framework ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.
- WID-SEC-W-2022-0169Oracle MySQL: Mehrere SchwachstellenDeutsch2022-04-19csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-0016IBM Tivoli Monitoring: Mehrere SchwachstellenDeutsch2023-01-03csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Tivoli Monitoring ausnutzen, um die Kontrolle über das System zu erlangen, vertrauliche Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, sowie weitere nicht spezifizierte Auswirkungen zu ereichen.
- WID-SEC-W-2023-0139Oracle Commerce: Mehrere SchwachstellenDeutsch2023-01-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Commerce ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-1012Oracle Insurance Applications: Mehrere SchwachstellenDeutsch2023-04-18csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Insurance Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-1016Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2023-04-18csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2024-0528Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2024-02-29csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.
- WID-SEC-W-2026-1955Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere SchwachstellenDeutsch2026-06-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
- cisco-sa-java-spring-rce-Zx9GUc67Vulnerability in Spring Framework Affecting Cisco Products: March 20222022-04-01csaf · cisco_csafUS
On March 31, 2022, the following critical vulnerability in the Spring Framework affecting Spring MVC and Spring WebFlux applications running on JDK 9+ was released: CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+ For a description of this vulnerability, see VMware Spring Framework Security Vulnerability Report ["https://tanzu.vmware.com/security/cve-2022-22965"].
- GHSA-36p3-wjmg-h94xRemote Code Execution in Spring Framework2022-03-31ghsa · osvUS
Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as `Spring4Shell`. ## Impact A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. These are the prerequisites for the exploit: - JDK 9 or higher - Apache Tomcat as the Servlet container - Packaged as WAR - `spring-webmvc` or `spring-webflux` dependency ## Patches - Spring Framework [5.3.18](https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18) and [5.2.20](https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE) - Spring Boot [2.6.6](https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6) and [2.5.12](https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12) ## Workarounds For those who are unable to upgrade, leaked reports recommend setting `disallowedFields` on `WebDataBinder` through an `@ControllerAdvice`. This works generally, but as a centrally applied workaround fix, may leave some loopholes, in particular if a controller sets `disallowedFields` locally through its own `@InitBinder` method, which overrides the global setting. To apply the workaround in a more fail-safe way, applications could extend `RequestMappingHandlerAdapter` to update the `WebDataBinder` at the end after all other initialization. In order to do that, a Spring Boot application can declare a `WebMvcRegistrations` bean (Spring MVC) or a `WebFluxRegistrations` bean (Spring WebFlux).
- ICSA-22-286-05Hitachi Energy Lumada Asset Performance Management Prognostic Model Executor Service2022-10-13icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could crash the Prognostic Model Executor and could allow remote code execution.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (54)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2022-22965cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdfcnnvd
- https://cxsecurity.com/cveshow/CVE-2022-22965/cnnvd
- https://packetstormsecurity.com/files/166691/Red-Hat-Security-Advisory-2022-1306-01.htmlcnnvd
- https://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.htmlcnnvd
- https://packetstormsecurity.com/files/166732/Red-Hat-Security-Advisory-2022-1379-01.htmlcnnvd
- https://packetstormsecurity.com/files/166874/Red-Hat-Security-Advisory-2022-1626-01.htmlcnnvd
- https://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.htmlcnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan