CVE-2022-22965

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-22965
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-22965.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-22965
Aliases
Downstream
Published
2022-04-01T22:17:30Z
Modified
2026-07-11T03:54:14.654551150Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Database specific 
{
    "cna_assigner": "vmware",
    "cwe_ids": [
        "CWE-94"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions"
                },
                {
                    "last_affected": "Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22965.json"
}
References

Affected packages

Git / github.com/spring-projects/spring-framework

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-framework
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cfa701b8726f06528e9d408b1b94f333f70da45f
Introduced
5acffaa72da10ba42fe547eeea44d8615cbf99b9
Fixed
707a24c48b21fc35e8be715afc80f020a24a9714
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.2.20"
        },
        {
            "introduced": "5.3.0"
        },
        {
            "fixed": "5.3.18"
        }
    ],
    "cpe": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Affected versions

v3.*
v3.2.0.M1
v3.2.0.M2
v3.2.0.RC1
v3.2.0.RC2-A
v3.2.0.RELEASE
v4.*
v4.0.0.M1
v4.0.0.M2
v4.0.0.M3
v4.0.0.RC1
v4.0.0.RC2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-22965.json"