CVE-2022-22965

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.996 · 100 %ileexploit · PoCDEEURUUS
grimoire priorityP0 · Act now
Exploitable?
Yes · in the wild
CISA KEV · 100 exploits · PoC
Likely / severe?
99.6% (100th) EPSS
CVSS 7.5 · high
Is it mine?
142 products
Check your exposure
Who says so?
8 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2022-04-04remediate by 2022-04-25

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-27

Spring Framework JDK 9+ Remote Code Execution Vulnerability

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

02

cvss

Technical severity, 0–10. One row per scoring source.

9.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9
v3.07.5highCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.18.8highAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · OSV
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Cisco PSIRT US
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-94USprimaryCWE-20USCWE-470USCWE-74USCWE-94USCWE-94US
05

ATT&CK techniques

ATT&CK techniques this enables or maps to.

06

exploits (100)

Public proof-of-concept and weaponised exploit code.

07

affected products (142)

Products and version ranges known to be affected.

showing 20 of 142
08

advisories (12)

Vendor and ecosystem advisories describing this.

  • SSA-254054SSA-254054: Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products2022-04-19csaf · siemens_psirtDE

    A vulnerability in Spring Framework was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2022-22965 and is also known as "Spring4Shell" or "SpringShell". Siemens has released updates for the affected products and recommends to update to the latest versions.

  • WID-SEC-W-2022-0033VMware Tanzu Spring Framework: Schwachstelle ermöglicht Ausführen von beliebigem ProgrammcodeDeutsch2022-03-30csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Framework ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.

  • WID-SEC-W-2022-0169Oracle MySQL: Mehrere SchwachstellenDeutsch2022-04-19csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2023-0016IBM Tivoli Monitoring: Mehrere SchwachstellenDeutsch2023-01-03csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Tivoli Monitoring ausnutzen, um die Kontrolle über das System zu erlangen, vertrauliche Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, sowie weitere nicht spezifizierte Auswirkungen zu ereichen.

  • WID-SEC-W-2023-0139Oracle Commerce: Mehrere SchwachstellenDeutsch2023-01-17csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Commerce ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2023-1012Oracle Insurance Applications: Mehrere SchwachstellenDeutsch2023-04-18csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Insurance Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2023-1016Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2023-04-18csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2024-0528Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2024-02-29csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.

  • WID-SEC-W-2026-1955Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere SchwachstellenDeutsch2026-06-16csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

  • cisco-sa-java-spring-rce-Zx9GUc67Vulnerability in Spring Framework Affecting Cisco Products: March 20222022-04-01csaf · cisco_csafUS

    On March 31, 2022, the following critical vulnerability in the Spring Framework affecting Spring MVC and Spring WebFlux applications running on JDK 9+ was released: CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+ For a description of this vulnerability, see VMware Spring Framework Security Vulnerability Report ["https://tanzu.vmware.com/security/cve-2022-22965"].

  • GHSA-36p3-wjmg-h94xRemote Code Execution in Spring Framework2022-03-31ghsa · osvUS

    Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as `Spring4Shell`. ## Impact A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. These are the prerequisites for the exploit: - JDK 9 or higher - Apache Tomcat as the Servlet container - Packaged as WAR - `spring-webmvc` or `spring-webflux` dependency ## Patches - Spring Framework [5.3.18](https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18) and [5.2.20](https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE) - Spring Boot [2.6.6](https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6) and [2.5.12](https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12) ## Workarounds For those who are unable to upgrade, leaked reports recommend setting `disallowedFields` on `WebDataBinder` through an `@ControllerAdvice`. This works generally, but as a centrally applied workaround fix, may leave some loopholes, in particular if a controller sets `disallowedFields` locally through its own `@InitBinder` method, which overrides the global setting. To apply the workaround in a more fail-safe way, applications could extend `RequestMappingHandlerAdapter` to update the `WebDataBinder` at the end after all other initialization. In order to do that, a Spring Boot application can declare a `WebMvcRegistrations` bean (Spring MVC) or a `WebFluxRegistrations` bean (Spring WebFlux).

  • ICSA-22-286-05Hitachi Energy Lumada Asset Performance Management Prognostic Model Executor Service2022-10-13icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities could crash the Prognostic Model Executor and could allow remote code execution.

09

also known as (4)

Other names and identifiers for this entity.

10

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducert_bundcisa_csaf_otsiemens_psirtcisco_csafosvNVDCVE.orgMITRE
published 2022-04-01modified 2026-06-17
12

references (54)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan