Skip to content

CVE watch CVE-2022-22965 Known exploited

Spring4Shell: RCE in Spring Framework

Data binding in Spring MVC on JDK 9+ could be abused to reach class-loader properties and write a web shell, giving remote code execution.

Severity: 9.8

critical
Vendor: VMware
Disclosed: 31 Mar 2022
Affected: Spring Framework 5.3.x, 5.2.x

CVSS breakdown

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Analysis

Placeholder analysis — replace before publishing.

References

nvd.nist.gov/vuln/detail/CVE-2022-22965