CVE-2022-22965

Published Apr 1, 2022

Last updated a year ago

Exploit knownCVSS critical 9.8
Spring4Shell
Mysql
hsm
Sonicwall
web application
Zero-day
IoT
Supply chain
Server
OT
Database

Overview

Description
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Source
security@vmware.com
NVD status
Analyzed
Products
spring_framework, cx_cloud_agent, communications_cloud_native_core_automated_test_suite, communications_cloud_native_core_console, communications_cloud_native_core_network_exposure_function, communications_cloud_native_core_network_function_cloud_native_environment, communications_cloud_native_core_network_repository_function, communications_cloud_native_core_network_slice_selection_function, communications_cloud_native_core_policy, communications_cloud_native_core_security_edge_protection_proxy, communications_cloud_native_core_unified_data_repository, communications_policy_management, financial_services_analytical_applications_infrastructure, financial_services_behavior_detection_platform, financial_services_enterprise_case_management, mysql_enterprise_monitor, product_lifecycle_analytics, retail_xstore_point_of_service, sd-wan_edge, operation_scheduler, sipass_integrated, siveillance_identity, access_appliance, flex_appliance, netbackup_flex_scale_appliance, netbackup_appliance, netbackup_virtual_appliance, simatic_speech_assistant_for_machines, sinec_network_management_system, commerce_platform, communications_cloud_native_core_binding_support_function, communications_unified_inventory_management, retail_bulk_data_integration, retail_customer_management_and_segmentation_foundation, retail_financial_integration, retail_integration_bus, retail_merchandising_system, weblogic_server

Insights

Analysis from the Intruder Security Team
Published Oct 15, 2024

The vulnerability affects Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, as well as all older versions. For an application to be fully vulnerable to the currently (13/04/2020) known vectors, a number of pre-requisites are required for the application to be vulnerable.

More information is available in our blog post here.

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

CVSS 2.0

Type
Primary
Base score
7.5
Impact score
6.4
Exploitability score
10
Vector string
AV:N/AC:L/Au:N/C:P/I:P/A:P

Known exploits

Data from CISA

Vulnerability name
Spring Framework JDK 9+ Remote Code Execution Vulnerability
Exploit added on
Apr 4, 2022
Exploit action due
Apr 25, 2022
Required action
Apply updates per vendor instructions.

Weaknesses

security@vmware.com
CWE-94
nvd@nist.gov
CWE-94

Social media

Hype score
Not currently trending

  1. Hey, world 🤙 I just released a few projects on GitHub: - Two PoCs for #CVE-2022-22965 and #CVE-2025-55182, written in C and Go. - A simple C# project demonstrating how AES encryption works. GitHub: https://t.co/uS2tdeNxeq More CVE exploit are coming, stay tuned Peace, ✌

    @RootEvil333

    8 Jul 2026

    60 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability•CVE-2026-94127
  2. Check Point Multiple Products Path Traversal Vulnerability•CVE-2026-93616
  3. Improper authorization leads to Remote Code Execution via SocketIO interface.•CVE-2026-25254
  4. Arista VeloCloud Orchestrator Improper Input Validation Vulnerability•CVE-2026-93952
  5. Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist, whose URL path was any Temporal HTTP API route, and whose header map contained a non-empty header named source. When the History service delivered that callback, the non-empty source header caused it to re-target the request at the local frontend client and rewrite only the scheme and host, preserving the caller's path, query, and request body. Where an internal frontend is deployed with its HTTP API enabled, that client resolves to the internal frontend, which authorizes every request as a system administrator without requiring authentication information. The result is that the server performs an attacker-chosen state-changing HTTP POST against its own administrative API on the caller's behalf, in namespaces where the caller has no permission. The caller never needs network access to the internal frontend, because the History service makes the request. Confirmed effects include terminating Workflows in other namespaces, registering namespaces, modifying another namespace's configuration, and deleting another namespace and its Workflows. The affected routing logic is present in both the HSM and CHASM callback delivery implementations. This description and the CVSS score in this record describe releases 1.30.0 and later, where any non-empty source header is sufficient. Releases 1.25.0 through 1.29.7 are affected by a narrower form of the same defect in which the header must exactly match a configured cluster ID, a UUID that a namespace-scoped caller cannot read through the API. The consequence once that match occurs is the same, but the attack is materially harder and scores lower. To determine whether a deployment is affected, check two settings together: the static Server configuration for a non-zero services.internal-frontend.rpc.httpPort, and the effective per-namespace dynamic configuration value of component.callbacks.allowedAddresses. A deployment is exposed only when an internal frontend is deployed with a non-zero HTTP port, at least one allowlist rule admits a host, and authorization is enabled. The allowlist is empty by default, which denies all external callback URLs, and the stock static topology does not include an internal frontend. Note that a failed attach returns the error 'invalid url: url does not match any configured callback address', which proves only that one tested URL did not match and does not prove the effective allowlist is empty. To look for callbacks already attached, use DescribeWorkflowExecution, which returns callback information for a Workflow's registered completion callbacks. Operators should be aware of a gap when searching for evidence of delivery: the frontend HTTP API server records the request method and URL at debug level only, so at default log levels a delivered request is not written to the internal frontend's logs, and the absence of such log entries is not evidence that the issue was not exploited.•CVE-2026-87858

References

Sources include official advisories and independent security research.