Read the docs
TI-2022-07142 Aliases CVE-2022-22965GHSA-36p3-wjmg-h94x

Code injection in Spring Framework

Priority CRITICAL 100Exploited in the wildCWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 7 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Why it matters now

Exploitation Active In CISA KEV since 2022-04-04CISA due date 2022-04-25
EPSS 0.99638 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.springframework:spring-beans (Maven): 5.2.20.RELEASE, 5.3.18org.springframework:spring-webmvc (Maven): 5.2.20.RELEASE, 5.3.18+3 more productsRed Hat: 7 advisoriesRed Hat: 7 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Spring FrameworkSpring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions—No fix listedCNA
—org.springframework:spring-beans (Maven)before 5.2.20.RELEASE5.2.20.RELEASEPatch availableGHSA-36p3-wjmg-h94x
—org.springframework:spring-beans (Maven)5.3.0 to before 5.3.185.3.18Patch availableGHSA-36p3-wjmg-h94x
—org.springframework:spring-webmvc (Maven)before 5.2.20.RELEASE5.2.20.RELEASEPatch availableGHSA-36p3-wjmg-h94x
—org.springframework:spring-webmvc (Maven)5.3.0 to before 5.3.185.3.18Patch availableGHSA-36p3-wjmg-h94x
—org.springframework.boot:spring-boot-starter-web (Maven)before 2.5.122.5.12Patch availableGHSA-36p3-wjmg-h94x
—org.springframework.boot:spring-boot-starter-web (Maven)2.6.0 to before 2.6.62.6.6Patch availableGHSA-36p3-wjmg-h94x
—org.springframework:spring-webflux (Maven)before 5.2.20.RELEASE5.2.20.RELEASEPatch availableGHSA-36p3-wjmg-h94x
—org.springframework:spring-webflux (Maven)5.3.0 to before 5.3.185.3.18Patch availableGHSA-36p3-wjmg-h94x
—org.springframework.boot:spring-boot-starter-webflux (Maven)before 2.5.122.5.12Patch availableGHSA-36p3-wjmg-h94x
—org.springframework.boot:spring-boot-starter-webflux (Maven)2.6.0 to before 2.6.62.6.6Patch availableGHSA-36p3-wjmg-h94x
  • Spring Framework Vendor— Affected Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions Fixed in — No fix listed CNA
  • org.springframework:spring-beans (Maven) Vendor— Affected before 5.2.20.RELEASE Fixed in 5.2.20.RELEASE Patch available GHSA-36p3-wjmg-h94x
  • org.springframework:spring-beans (Maven) Vendor— Affected 5.3.0 to before 5.3.18 Fixed in 5.3.18 Patch available GHSA-36p3-wjmg-h94x
  • org.springframework:spring-webmvc (Maven) Vendor— Affected before 5.2.20.RELEASE Fixed in 5.2.20.RELEASE Patch available GHSA-36p3-wjmg-h94x
  • org.springframework:spring-webmvc (Maven) Vendor— Affected 5.3.0 to before 5.3.18 Fixed in 5.3.18 Patch available GHSA-36p3-wjmg-h94x
  • org.springframework.boot:spring-boot-starter-web (Maven) Vendor— Affected before 2.5.12 Fixed in 2.5.12 Patch available GHSA-36p3-wjmg-h94x
  • org.springframework.boot:spring-boot-starter-web (Maven) Vendor— Affected 2.6.0 to before 2.6.6 Fixed in 2.6.6 Patch available GHSA-36p3-wjmg-h94x
  • org.springframework:spring-webflux (Maven) Vendor— Affected before 5.2.20.RELEASE Fixed in 5.2.20.RELEASE Patch available GHSA-36p3-wjmg-h94x
  • org.springframework:spring-webflux (Maven) Vendor— Affected 5.3.0 to before 5.3.18 Fixed in 5.3.18 Patch available GHSA-36p3-wjmg-h94x
  • org.springframework.boot:spring-boot-starter-webflux (Maven) Vendor— Affected before 2.5.12 Fixed in 2.5.12 Patch available GHSA-36p3-wjmg-h94x
  • org.springframework.boot:spring-boot-starter-webflux (Maven) Vendor— Affected 2.6.0 to before 2.6.6 Fixed in 2.6.6 Patch available GHSA-36p3-wjmg-h94x

CPE configurations NVD · 89

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*before 5.2.20; 5.3.0 to before 5.3.18VulnerableVMware
cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*9Running onOracle
cpe:2.3:a:cisco:cx_cloud_agent:*:*:*:*:*:*:*:*before 2.1.0VulnerableCisco
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_console:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
  • cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions before 5.2.20; 5.3.0 to before 5.3.18 Vulnerable ·VMware
  • cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:* Versions 9 Running on ·Oracle
  • cpe:2.3:a:cisco:cx_cloud_agent:*:*:*:*:*:*:*:* Versions before 2.1.0 Vulnerable ·Cisco
  • cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_console:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
Show 79 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*12.6.0.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:*:*:*:*:*:*:*8.1.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:*8.1.2.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*8.1.1.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*8.1.1.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*8.1.2.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*8.1.1.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*8.1.1.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.0:*:*:*:*:*:*:*8.1.2.0VulnerableOracle
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*before 8.0.29VulnerableOracle
cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*3.6.1VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*20.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.0:*:*:*:*:*:*:*21.0.0VulnerableOracle
cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*9.0VulnerableOracle
cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*9.1VulnerableOracle
cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*before 2.0.4VulnerableSiemens
cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*2.80VulnerableSiemens
cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*2.85VulnerableSiemens
cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*1.5VulnerableSiemens
cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*1.6VulnerableSiemens
cpe:2.3:a:veritas:access_appliance:7.4.3:*:*:*:*:*:*:*7.4.3VulnerableVeritas
cpe:2.3:a:veritas:access_appliance:7.4.3.100:*:*:*:*:*:*:*7.4.3.100VulnerableVeritas
cpe:2.3:a:veritas:access_appliance:7.4.3.200:*:*:*:*:*:*:*7.4.3.200VulnerableVeritas
cpe:2.3:a:veritas:flex_appliance:1.3:*:*:*:*:*:*:*1.3VulnerableVeritas
cpe:2.3:a:veritas:flex_appliance:2.0:*:*:*:*:*:*:*2.0VulnerableVeritas
cpe:2.3:a:veritas:flex_appliance:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableVeritas
cpe:2.3:a:veritas:flex_appliance:2.0.2:*:*:*:*:*:*:*2.0.2VulnerableVeritas
cpe:2.3:a:veritas:flex_appliance:2.1:*:*:*:*:*:*:*2.1VulnerableVeritas
cpe:2.3:a:veritas:netbackup_flex_scale_appliance:2.1:*:*:*:*:*:*:*2.1VulnerableVeritas
cpe:2.3:a:veritas:netbackup_flex_scale_appliance:3.0:*:*:*:*:*:*:*3.0VulnerableVeritas
cpe:2.3:h:veritas:netbackup_appliance:4.0:*:*:*:*:*:*:*4.0VulnerableVeritas
cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release1:*:*:*:*:*:*4.0.0.1 maintenance_release1VulnerableVeritas
cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release2:*:*:*:*:*:*4.0.0.1 maintenance_release2VulnerableVeritas
cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release3:*:*:*:*:*:*4.0.0.1 maintenance_release3VulnerableVeritas
cpe:2.3:h:veritas:netbackup_appliance:4.1:*:*:*:*:*:*:*4.1VulnerableVeritas
cpe:2.3:h:veritas:netbackup_appliance:4.1.0.1:maintenance_release1:*:*:*:*:*:*4.1.0.1 maintenance_release1VulnerableVeritas
cpe:2.3:h:veritas:netbackup_appliance:4.1.0.1:maintenance_release2:*:*:*:*:*:*4.1.0.1 maintenance_release2VulnerableVeritas
cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0:*:*:*:*:*:*:*4.0VulnerableVeritas
cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release1:*:*:*:*:*:*4.0.0.1 maintenance_release1VulnerableVeritas
cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release2:*:*:*:*:*:*4.0.0.1 maintenance_release2VulnerableVeritas
cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release3:*:*:*:*:*:*4.0.0.1 maintenance_release3VulnerableVeritas
cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1:*:*:*:*:*:*:*4.1VulnerableVeritas
cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1.0.1:maintenance_release1:*:*:*:*:*:*4.1.0.1 maintenance_release1VulnerableVeritas
cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1.0.1:maintenance_release2:*:*:*:*:*:*4.1.0.1 maintenance_release2VulnerableVeritas
cpe:2.3:a:siemens:simatic_speech_assistant_for_machines:*:*:*:*:*:*:*:*before 1.2.1VulnerableSiemens
cpe:2.3:a:siemens:sinec_network_management_system:*:*:*:*:*:*:*:*before 1.0.3VulnerableSiemens
cpe:2.3:a:oracle:commerce_platform:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*22.1.3VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*7.4.1VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*7.4.2VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:*7.5.0VulnerableOracle
cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*17.0VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*18.0VulnerableOracle
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*19.0VulnerableOracle
cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*14.1.3.2VulnerableOracle
cpe:2.3:a:oracle:retail_financial_integration:15.0.3.1:*:*:*:*:*:*:*15.0.3.1VulnerableOracle
cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_financial_integration:19.0.1:*:*:*:*:*:*:*19.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*14.1.3.2VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1:*:*:*:*:*:*:*15.0.3.1VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:*19.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:*19.0.1VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:* Versions 12.6.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1:*:*:*:*:*:*:* Versions 8.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:* Versions 8.1.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:* Versions 8.1.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:* Versions 8.1.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:* Versions 8.1.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:* Versions 8.1.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:* Versions 8.1.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.0:*:*:*:*:*:*:* Versions 8.1.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions before 8.0.29 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:* Versions 3.6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:* Versions 20.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.0:*:*:*:*:*:*:* Versions 21.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:* Versions 9.1 Vulnerable ·Oracle
  • cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:* Versions before 2.0.4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:* Versions 2.80 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:* Versions 2.85 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·Siemens
  • cpe:2.3:a:veritas:access_appliance:7.4.3:*:*:*:*:*:*:* Versions 7.4.3 Vulnerable ·Veritas
  • cpe:2.3:a:veritas:access_appliance:7.4.3.100:*:*:*:*:*:*:* Versions 7.4.3.100 Vulnerable ·Veritas
  • cpe:2.3:a:veritas:access_appliance:7.4.3.200:*:*:*:*:*:*:* Versions 7.4.3.200 Vulnerable ·Veritas
  • cpe:2.3:a:veritas:flex_appliance:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Veritas
  • cpe:2.3:a:veritas:flex_appliance:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Veritas
  • cpe:2.3:a:veritas:flex_appliance:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Veritas
  • cpe:2.3:a:veritas:flex_appliance:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Veritas
  • cpe:2.3:a:veritas:flex_appliance:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Veritas
  • cpe:2.3:a:veritas:netbackup_flex_scale_appliance:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Veritas
  • cpe:2.3:a:veritas:netbackup_flex_scale_appliance:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Veritas
  • cpe:2.3:h:veritas:netbackup_appliance:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Veritas
  • cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release1:*:*:*:*:*:* Versions 4.0.0.1 maintenance_release1 Vulnerable ·Veritas
  • cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release2:*:*:*:*:*:* Versions 4.0.0.1 maintenance_release2 Vulnerable ·Veritas
  • cpe:2.3:h:veritas:netbackup_appliance:4.0.0.1:maintenance_release3:*:*:*:*:*:* Versions 4.0.0.1 maintenance_release3 Vulnerable ·Veritas
  • cpe:2.3:h:veritas:netbackup_appliance:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Veritas
  • cpe:2.3:h:veritas:netbackup_appliance:4.1.0.1:maintenance_release1:*:*:*:*:*:* Versions 4.1.0.1 maintenance_release1 Vulnerable ·Veritas
  • cpe:2.3:h:veritas:netbackup_appliance:4.1.0.1:maintenance_release2:*:*:*:*:*:* Versions 4.1.0.1 maintenance_release2 Vulnerable ·Veritas
  • cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Veritas
  • cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release1:*:*:*:*:*:* Versions 4.0.0.1 maintenance_release1 Vulnerable ·Veritas
  • cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release2:*:*:*:*:*:* Versions 4.0.0.1 maintenance_release2 Vulnerable ·Veritas
  • cpe:2.3:h:veritas:netbackup_virtual_appliance:4.0.0.1:maintenance_release3:*:*:*:*:*:* Versions 4.0.0.1 maintenance_release3 Vulnerable ·Veritas
  • cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Veritas
  • cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1.0.1:maintenance_release1:*:*:*:*:*:* Versions 4.1.0.1 maintenance_release1 Vulnerable ·Veritas
  • cpe:2.3:h:veritas:netbackup_virtual_appliance:4.1.0.1:maintenance_release2:*:*:*:*:*:* Versions 4.1.0.1 maintenance_release2 Vulnerable ·Veritas
  • cpe:2.3:a:siemens:simatic_speech_assistant_for_machines:*:*:*:*:*:*:*:* Versions before 1.2.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_network_management_system:*:*:*:*:*:*:*:* Versions before 1.0.3 Vulnerable ·Siemens
  • cpe:2.3:a:oracle:commerce_platform:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:* Versions 22.1.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:* Versions 7.4.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:* Versions 7.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:* Versions 18.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* Versions 19.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:* Versions 14.1.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_financial_integration:15.0.3.1:*:*:*:*:*:*:* Versions 15.0.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_financial_integration:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:* Versions 14.1.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1:*:*:*:*:*:*:* Versions 15.0.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-36p3-wjmg-h94x org.springframework:spring-beans (Maven) Fixed in 5.2.20.RELEASE Advisory →
  • Fix · GHSA-36p3-wjmg-h94x org.springframework:spring-beans (Maven) Fixed in 5.3.18 Advisory →
  • Fix · GHSA-36p3-wjmg-h94x org.springframework:spring-webmvc (Maven) Fixed in 5.2.20.RELEASE Advisory →
  • Fix · GHSA-36p3-wjmg-h94x org.springframework:spring-webmvc (Maven) Fixed in 5.3.18 Advisory →
  • Fix · GHSA-36p3-wjmg-h94x org.springframework.boot:spring-boot-starter-web (Maven) Fixed in 2.5.12 Advisory →
  • Fix · GHSA-36p3-wjmg-h94x org.springframework.boot:spring-boot-starter-web (Maven) Fixed in 2.6.6 Advisory →
  • Fix · GHSA-36p3-wjmg-h94x org.springframework:spring-webflux (Maven) Fixed in 5.2.20.RELEASE Advisory →
  • Fix · GHSA-36p3-wjmg-h94x org.springframework:spring-webflux (Maven) Fixed in 5.3.18 Advisory →
  • Fix · GHSA-36p3-wjmg-h94x org.springframework.boot:spring-boot-starter-webflux (Maven) Fixed in 2.5.12 Advisory →
  • Fix · GHSA-36p3-wjmg-h94x org.springframework.boot:spring-boot-starter-webflux (Maven) Fixed in 2.6.6 Advisory →

Red Hat 7 advisories

  • RHSA-2022:1627 Released 2022-04-27 · Red Hat rating Low
    Red Hat AMQ Broker 7.9.4 release and security update
    • Red Hat AMQ 7.9.4
  • RHSA-2022:1626 Released 2022-04-27 · Red Hat rating Low
    Red Hat AMQ Broker 7.8.6 release and security update
    • Red Hat AMQ 7.8.6
  • RHSA-2022:1379 Released 2022-04-14 · Red Hat rating Low
    Red Hat Decision Manager 7.12.1 security update
    • RHDM 7.12.1 async
Show 4 more Red Hat advisories
  • RHSA-2022:1378 Released 2022-04-14 · Red Hat rating Low
    Red Hat Process Automation Manager 7.12.1 security update
    • RHPAM 7.12.1 async
  • RHSA-2022:1360 Released 2022-04-13 · Red Hat rating Low
    Red Hat Fuse 7.10.2 release and security update
    • Red Hat Fuse 7.10.2
  • RHSA-2022:1333 Released 2022-04-12 · Red Hat rating Low
    Red Hat Integration Camel-K 1.6.5 security update
    • RHINT Camel-K 1.6.5
  • RHSA-2022:1306 Released 2022-04-11 · Red Hat rating Low
    Red Hat Integration Camel Extensions for Quarkus 2.2.1-1 security update
    • CEQ 2.2.1-1 (CVE-2022-22965)

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat JBoss A-MQ 6AffectedNo fix yet: Fix deferred
Red Hat JBoss Fuse 6AffectedNo fix yet: Fix deferred
Red Hat Virtualization 4AffectedNo fix yet: Fix deferred
CEQ 2.2.1-1 (CVE-2022-22965)Fixed RHSA-2022:1306
RHDM 7.12.1 asyncFixed RHSA-2022:1379
RHINT Camel-K 1.6.5Fixed RHSA-2022:1333
RHPAM 7.12.1 asyncFixed RHSA-2022:1378
Red Hat AMQ 7.8.6Fixed RHSA-2022:1626
Red Hat AMQ 7.9.4Fixed RHSA-2022:1627
Red Hat Fuse 7.10.2Fixed RHSA-2022:1360

Timeline

  1. 2022-04-04 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2022-22965
  3. 2026-10-03 Alias added: GHSA-36p3-wjmg-h94x

References

Exploit 1

Patch 2

Advisory 6

Other 9

  • TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
  • TI-2018-01180 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2016-09283 Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution… CVSS 3.1CRITICAL 9.8
  • TI-2014-00050 The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8… CVSS 2.0MEDIUM 6.8
  • TI-2013-05382 The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and… CVSS 2.0MEDIUM 6.8
See all 82 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences