Threat Advisory: Spring4Shell
Summary: Cisco Talos reported that CVE-2022-22965, known as Spring4Shell, is a high-severity class manipulation vulnerability in Spring MVC and Spring WebFlux that can be exploited through a specially crafted HTTP request to achieve remote code execution, and it appears to bypass mitigations for CVE-2010-1622. The Kenna Risk Score for the flaw is at a maximum 100, a level reached by only 415 of 184,000 CVEs (0.22 percent), with reports of exploitation in the wild and patches available in Spring Framework 5.3.18 or 5.2.20.
Why it matters: A maximum risk score of 100, reached by just 0.22 percent of the 184,000 tracked CVEs, reflects a widely deployed technology with a public exploit and proof of an active internet breach - and applications deployed as Spring Boot executable jars were noted as not vulnerable at the time of writing, a status Talos said could change.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2010-1622CVE-2022-22963CVE-2022-22965
- Related
- CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild (Spring Shell) (Updated) Cyber Risks ·CVE-2022-22963: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Aug 25, 2022CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Apr 04, 2022