CVE-2022-22965: presente nel catalogo CISA KEV CVE-2022-22965 · CVSS 9.8 CRITICAL · EPSS 99.6% · KEV 2022-04-04 · patch disponibile
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22965 viene sfruttato? Inserito nel catalogo CISA KEV il 2022-04-04. Scadenza di remediation federale: 2022-04-25. Oltre quella data da 1649 giorni. EPSS stima la probabilità di sfruttamento nei prossimi 30 giorni al 99.6%. Codice di exploit pubblico: integrato in uno strumento pubblico. Esistono regole di detection pubbliche. Quali prodotti e versioni sono interessati? Spring Framework · Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions cisco · cx cloud agent · < 2.1.0 oracle · communications cloud native core automated test suite · 1.9.0, 22.1.0 oracle · communications cloud native core console · 1.9.0, 22.1.0 oracle · communications cloud native core network exposure function · 22.1.0 oracle · communications cloud native core network function cloud native environment · 1.10.0, 22.1.0 oracle · communications cloud native core network repository function · 1.15.0, 22.1.0 oracle · communications cloud native core network slice selection function · 1.8.0, 1.15.0, 22.1.0 oracle · communications cloud native core policy · 1.15.0, 22.1.0 oracle · communications cloud native core security edge protection proxy · 1.7.0, 22.1.0 oracle · communications cloud native core unified data repository · 1.15.0, 22.1.0 oracle · communications policy management · 12.6.0.0.0 oracle · financial services analytical applications infrastructure · 8.1.1, 8.1.2.0 oracle · financial services behavior detection platform · 8.1.1.0, 8.1.1.1, 8.1.2.0 oracle · financial services enterprise case management · 8.1.1.0, 8.1.1.1, 8.1.2.0 oracle · mysql enterprise monitor · < 8.0.29 oracle · product lifecycle analytics · 3.6.1 oracle · retail xstore point of service · 20.0.1, 21.0.0 oracle · sd-wan edge · 9.0, 9.1 siemens · operation scheduler · < 2.0.4 Esiste una patch? Sì. Aggiorna a una di queste versioni o successive:
cx cloud agent 2.1.0 mysql enterprise monitor 8.0.29 operation scheduler 2.0.4
Dall'analisi di NVD
Cosa ha pubblicato PlainSec su CVE-2022-22965 PlainSec non ha pubblicato storie su questo CVE.
Fonti primarie KEV ed EPSS vengono ricontrollati ogni giorno. Scheda aggiornata il 2026-08-24.
CVE-2022-22965: presente nel catalogo CISA KEV CVE-2022-22965 · CVSS 9.8 CRITICAL · EPSS 99.6% · KEV 2022-04-04 · patch disponibile
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22965 viene sfruttato? Inserito nel catalogo CISA KEV il 2022-04-04. Scadenza di remediation federale: 2022-04-25. Oltre quella data da 1649 giorni. EPSS stima la probabilità di sfruttamento nei prossimi 30 giorni al 99.6%. Codice di exploit pubblico: integrato in uno strumento pubblico. Esistono regole di detection pubbliche. Quali prodotti e versioni sono interessati? Spring Framework · Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions cisco · cx cloud agent · < 2.1.0 oracle · communications cloud native core automated test suite · 1.9.0, 22.1.0 oracle · communications cloud native core console · 1.9.0, 22.1.0 oracle · communications cloud native core network exposure function · 22.1.0 oracle · communications cloud native core network function cloud native environment · 1.10.0, 22.1.0 oracle · communications cloud native core network repository function · 1.15.0, 22.1.0 oracle · communications cloud native core network slice selection function · 1.8.0, 1.15.0, 22.1.0 oracle · communications cloud native core policy · 1.15.0, 22.1.0 oracle · communications cloud native core security edge protection proxy · 1.7.0, 22.1.0 oracle · communications cloud native core unified data repository · 1.15.0, 22.1.0 oracle · communications policy management · 12.6.0.0.0 oracle · financial services analytical applications infrastructure · 8.1.1, 8.1.2.0 oracle · financial services behavior detection platform · 8.1.1.0, 8.1.1.1, 8.1.2.0 oracle · financial services enterprise case management · 8.1.1.0, 8.1.1.1, 8.1.2.0 oracle · mysql enterprise monitor · < 8.0.29 oracle · product lifecycle analytics · 3.6.1 oracle · retail xstore point of service · 20.0.1, 21.0.0 oracle · sd-wan edge · 9.0, 9.1 siemens · operation scheduler · < 2.0.4 Esiste una patch? Sì. Aggiorna a una di queste versioni o successive:
cx cloud agent 2.1.0 mysql enterprise monitor 8.0.29 operation scheduler 2.0.4
Dall'analisi di NVD
Cosa ha pubblicato PlainSec su CVE-2022-22965 PlainSec non ha pubblicato storie su questo CVE.
Fonti primarie KEV ed EPSS vengono ricontrollati ogni giorno. Scheda aggiornata il 2026-08-24.