CVE-2022-22965: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The vulnerability affects versions 5.3.0 and above of Spring Framework and JDK 9 and above.
The vulnerability allows an attacker to execute arbitrary code on a vulnerable Spring application running on JDK 9+ if the application is deployed as a WAR file. This could lead to unauthorized access, data theft, or system compromise.
Recommended action: Upgrade to Spring Framework versions 5.2.20 or 5.3.18, or JDK versions below 9. Ensure applications are not deployed as WAR files but rather as Spring Boot executable jars.
Read the verified Spring Framework brief on DevCurrent: https://devcurrent.net/cve/CVE-2022-22965?utm_source=devto&utm_medium=community&utm_campaign=editorial_distribution&utm_content=58
Top comments (0)