crítica
CVE-2022-22965
spring-framework: RCE via Data Binding on JDK 9+
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Red Hat (alta), Ubuntu (alta).
Descripción
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.springframework.boot:spring-boot-starter-web, org.springframework.boot:spring-boot-starter-webflux, org.springframework:spring-beans y 2 más | 2.5.12, 2.6.6 y 1 más |
| debian 11 | libspring-java | sin corrección indicada |
| debian 12 | libspring-java | sin corrección indicada |
| debian 13 | libspring-java | sin corrección indicada |
| debian 14 | libspring-java | sin corrección indicada |
| echo | libspring-java | sin corrección indicada |
| rapidfort debian 12 | libspring-java | sin corrección indicada |
| rapidfort debian 13 | libspring-java | sin corrección indicada |
| Red Hat | rhvm-dependencies | sin corrección indicada |
| seal maven::Seal Security Database | org.springframework:spring, seal.sp1.org.springframework:spring | 2.5.6+sp2p2 y 1 más |
| ubuntu 18.04-ESM | libspring-java | 4.3.22-1~18.04.1~esm1 |
| ubuntu 20.04-ESM | libspring-java | 4.3.22-4ubuntu0.1~esm1 |
Mostrar las 24 entradas de 19 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.springframework.boot:spring-boot-starter-web | 2.5.12, 2.6.6 |
| maven::GitHub Security Advisory Maven | org.springframework.boot:spring-boot-starter-webflux | 2.5.12, 2.6.6 |
| maven::GitHub Security Advisory Maven | org.springframework:spring-beans | 5.2.20.RELEASE, 5.3.18 |
| maven::GitHub Security Advisory Maven | org.springframework:spring-webflux | 5.2.20.RELEASE, 5.3.18 |
| maven::GitHub Security Advisory Maven | org.springframework:spring-webmvc | 5.2.20.RELEASE, 5.3.18 |
| debian 11 | libspring-java | sin corrección indicada |
| debian 12 | libspring-java | sin corrección indicada |
| debian 13 | libspring-java | sin corrección indicada |
| debian 14 | libspring-java | sin corrección indicada |
| echo | libspring-java | sin corrección indicada |
| rapidfort debian 12 | libspring-java | sin corrección indicada |
| rapidfort debian 13 | libspring-java | sin corrección indicada |
| Red Hat | rhvm-dependencies | sin corrección indicada |
| seal maven::Seal Security Database | org.springframework:spring | 2.5.6+sp2p2 |
| seal maven::Seal Security Database | seal.sp1.org.springframework:spring | 2.5.6+sp999 |
| ubuntu 18.04-ESM | libspring-java | 4.3.22-1~18.04.1~esm1 |
| ubuntu 20.04-ESM | libspring-java | 4.3.22-4ubuntu0.1~esm1 |
| ubuntu 22.04 | libspring-java | sin corrección indicada |
| ubuntu 24.04 | libspring-java | sin corrección indicada |
| ubuntu 24.10 | libspring-java | 4.3.30-2ubuntu0.24.10.1 |
| ubuntu 25.04 | libspring-java | 4.3.30-2ubuntu1 |
| ubuntu 25.10 | libspring-java | 4.3.30-2ubuntu1 |
| ubuntu 26.04 | libspring-java | 4.3.30-2ubuntu1 |
| ubuntu 26.10 | libspring-java | 4.3.30-2ubuntu1 |
Referencias
- http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
- http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
- https://access.redhat.com/security/cve/CVE-2022-22965
- https://bugalert.org/content/notices/2022-03-30-spring.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
- https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12
- https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6
- https://github.com/spring-projects/spring-framework
Las 26 referencias
- https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15
- https://github.com/spring-projects/spring-framework/issues/28260
- https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE
- https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18
- https://nvd.nist.gov/vuln/detail/CVE-2022-22965
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
- https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
- https://tanzu.vmware.com/security/cve-2022-22965
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
- https://ubuntu.com/security/notices/USN-7165-1
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965
- https://www.cve.org/CVERecord?id=CVE-2022-22965
- https://www.cyberkendra.com/2022/03/spring4shell-details-and-exploit-code.html
- https://www.kb.cert.org/vuls/id/970766
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.praetorian.com/blog/spring-core-jdk9-rce/