A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Connections 40
has cited scope1 retained · stored CVE-2022-22965 → n/a · Spring Framework1400c2d9-3e3c-4f3f-b99b-4244633f9261
has environmental constraint1 retained · stored CVE-2022-22965 → oracle · jdk2b1318fb-008e-40c8-a582-efc5ff7ef5fe
has vulnerable target scope2 retained · stored CVE-2022-22965 → oracle · communications_cloud_native_core_console19ad2d25-0281-49a0-ad00-73961bf65a7f32f9a88f-aa0b-4606-94b6-82641425a3f2
has vulnerable target scope1 retained · stored CVE-2022-22965 → siemens · simatic_speech_assistant_for_machines768ff864-18f4-4f8a-af27-c272fb2f2472
has vulnerable target scope2 retained · stored CVE-2022-22965 → vmware · spring_framework7da5e678-c26e-4448-8718-ac87ef7b163fc742a187-b12e-4916-98cd-d410940e93ab
has vulnerable target scope2 retained · stored CVE-2022-22965 → oracle · communications_cloud_native_core_unified_data_repository0f556f14-2d82-44db-8aa5-be4c4f782d1442d2cc6c-515f-48d8-b9de-070441033eb1
has vulnerable target scope2 retained · stored CVE-2022-22965 → veritas · netbackup_flex_scale_appliance3db6a9b8-c768-4f25-9dee-7b49e9a1c40196af18fc-71da-4ed6-9935-84aa6f817947
has vulnerable target scope5 retained · stored CVE-2022-22965 → veritas · flex_appliance1c7347da-0f0e-46b1-b771-84be7718718234db1b03-3315-42da-833f-8aa623305e9f698bdc92-93ae-425f-a3fb-e8f24d5463ad9d1e6a97-4251-4675-92da-05ac1a6790ef9f5f4b83-2d85-45e6-8f45-8a92a162f53a
has vulnerable target scope2 retained · stored CVE-2022-22965 → oracle · communications_cloud_native_core_automated_test_suite215f3e31-4aa3-4084-88a4-08f0b13ec72559fbca05-c491-4768-8e48-14781cf3884f
has vulnerable target scope2 retained · stored CVE-2022-22965 → oracle · sd-wan_edge5902c32e-073f-4056-940e-3c9c8b0ba7ca913edaaa-f45a-4b63-9b4f-72c2f12dfa3e
has vulnerable target scope3 retained · stored CVE-2022-22965 → oracle · retail_customer_management_and_segmentation_foundation24d5db4f-9b6a-4fa1-8333-f43e5c58f8c93b11b157-19db-461c-923e-ee3d81b0a64b67efcfe7-9c24-4a63-81a7-5c53a059b8ff
has vulnerable target scope2 retained · stored CVE-2022-22965 → oracle · communications_cloud_native_core_policy494d9981-13a5-46e3-b2d8-8b8ece8c98ebb9b13c9e-359d-4b16-8c59-20368dcea102
has vulnerable target scope4 retained · stored CVE-2022-22965 → siemens · siveillance_identity2f302df2-8341-420d-a024-36608215e6e34fcb65c0-0918-4664-aec1-b2cd857b08fa70e3693d-3902-424f-8002-6ef49d7f4605d9566ac2-377a-40b0-b40f-9ee6acd3d57c
has vulnerable target scope7 retained · stored CVE-2022-22965 → veritas · netbackup_virtual_appliance0f461be5-1ad1-4adf-afdc-6c753687ceaf384cc804-5f87-458b-b563-9202bab44bbc3d31bd43-d350-4d9e-8020-4912a71b977e52c91b45-381f-4797-ba06-dfa66c9e481c5f05d0f4-80a0-412f-96fc-1cdd2275bcd95f2713f5-cc27-4c9a-81f8-cf71d61b27e2
has vulnerable target scope1 retained · stored CVE-2022-22965 → cisco · cx_cloud_agent42b274f6-4f3b-4d48-ba61-3fa5a16c6f41
has vulnerable target scope4 retained · stored CVE-2022-22965 → oracle · retail_integration_bus1f9e4d33-0e69-4e9b-94e9-7a19a5f55e997eac61e7-8e40-4fa0-b880-56c374bc2495a495c5e6-3959-4662-bf73-5e761b564abea9a5ecf2-b767-43e8-a48d-3eb810f784e2
has vulnerable target scope1 retained · stored CVE-2022-22965 → oracle · mysql_enterprise_monitor28934bd6-0f5e-4538-af10-c6b91048e467
has vulnerable target scope3 retained · stored CVE-2022-22965 → oracle · financial_services_behavior_detection_platform1ca43889-585d-433f-88c6-7151340b877e2899303b-7252-4071-b0d6-a524ba6c7189a4173412-5091-4138-8939-4b00f8bd3ba3
has vulnerable target scope4 retained · stored CVE-2022-22965 → oracle · retail_financial_integration08055ac3-eebd-4d5b-a21e-e1ccb6ba85962a4da79a-d52d-489f-88c3-f64abe51a7ec554800a2-21f4-40b4-8396-e7241cede86bc0cb0830-6b24-4ea9-93cf-ca6be8de44eb
has vulnerable target scope3 retained · stored CVE-2022-22965 → oracle · weblogic_server188139ba-ae3e-48e6-8da1-56f6ede92a22f9b26f5e-1d2c-417e-91a9-9bf4ca483a67fdc65ef7-c8ef-4ddc-be69-e0a31f4374a7
has vulnerable target scope2 retained · stored CVE-2022-22965 → oracle · communications_cloud_native_core_network_repository_function57893c3c-903f-4a41-80cc-64c40baa4b6dd9c3d813-9f52-4b2e-84cf-15ebaf6962e9
has vulnerable target scope7 retained · stored CVE-2022-22965 → veritas · netbackup_appliance0c697060-47f4-4106-b84c-3f3c6bed5a3f38b494f4-f7de-47cd-9cea-396a75417a4254316309-e7e5-47cc-85be-9604851a19579a1266bd-d459-4084-9303-f0563aba7381a9538596-169d-436b-b41a-0fd064d6c53fbcc3a4f6-9da1-49aa-bf18-cc4db58bb3b8
has vulnerable target scope3 retained · stored CVE-2022-22965 → oracle · communications_unified_inventory_management0f7f10f1-85a1-45eb-8476-16258f7bb2ed5f6a0b3b-2ce4-4dc6-8f62-fba6b71de20c6fe5d233-9cdf-45d7-a43a-2e72c28c2ade
has vulnerable target scope1 retained · stored CVE-2022-22965 → oracle · communications_cloud_native_core_binding_support_functiona28093c4-81f0-4135-bf84-b7827a8b1267
has vulnerable target scope2 retained · stored CVE-2022-22965 → siemens · operation_scheduler0a7bce5a-d80f-4a87-a44e-1783c05c977f987e5f88-f40a-4169-9e0a-c80ca4e0c607
has vulnerable target scope1 retained · stored CVE-2022-22965 → oracle · product_lifecycle_analytics05190080-965e-4838-8191-f1f1783a3a68
has vulnerable target scope2 retained · stored CVE-2022-22965 → oracle · communications_cloud_native_core_network_function_cloud_native_environment6b28089f-ee4a-45fd-b495-5d68bf2bee38d3397274-a6dc-4e49-b511-cef453675117
has vulnerable target scope1 retained · stored CVE-2022-22965 → oracle · communications_cloud_native_core_network_exposure_functioncbec4e82-0e38-45f9-905c-2189df907468
has vulnerable target scope2 retained · stored CVE-2022-22965 → oracle · financial_services_analytical_applications_infrastructure0a252466-af88-4c7f-a1db-c7785822d995523b9125-0b91-44a8-ba5a-84b071577dab
has vulnerable target scope1 retained · stored CVE-2022-22965 → oracle · retail_bulk_data_integration8bbfb35b-d694-402a-b8e6-91b6d93bbc33
has vulnerable target scope2 retained · stored CVE-2022-22965 → oracle · retail_xstore_point_of_service44be1464-14f2-46e2-943e-223632477fe7a1db46d3-1563-498c-b069-e257ce4067f9
has vulnerable target scope6 retained · stored CVE-2022-22965 → veritas · access_appliance69719a00-150c-486e-9c79-ff52da1141de76fe926a-0ae0-4eae-81ff-c0c1b70e4fe481ff99c9-696f-40c3-bcdf-f03c8a120423847beae8-3dc7-4812-83e8-771fa94badde9f45f8f0-1ce1-4c4f-916a-57e78eae17f1f34edad7-8aee-4076-8af2-810ba924be51
has vulnerable target scope1 retained · stored CVE-2022-22965 → oracle · communications_policy_managementa3851070-854a-4a2b-b6e2-da8909eaf97d
has vulnerable target scope3 retained · stored CVE-2022-22965 → oracle · financial_services_enterprise_case_management2e282c2f-3116-4666-b1af-2698133c9d3344603af8-5adf-4326-aff8-c07971b0f4b7e459674d-98fa-4062-9f29-861a2decc500
has vulnerable target scope1 retained · stored CVE-2022-22965 → oracle · commerce_platform7daa2ee9-cd16-4882-b96c-9b95dd2bb549
has vulnerable target scope4 retained · stored CVE-2022-22965 → siemens · sipass_integrated24515114-3556-4fbf-b6ef-6067a6cb7d0b3674670b-e207-44fb-b513-e51e33ffcf967d665ff4-4d33-4f7d-b042-debbd55fc7dffa4e42d0-46fb-4f0e-8cbc-8ff045b897b5
has vulnerable target scope3 retained · stored CVE-2022-22965 → oracle · communications_cloud_native_core_network_slice_selection_function3749df59-f241-4d06-a481-f419224369577c7c0fd0-4528-4558-bce0-904e264f5b8ba2b9caae-c363-43a4-91c9-db251cce552f
has vulnerable target scope2 retained · stored CVE-2022-22965 → oracle · communications_cloud_native_core_security_edge_protection_proxyb38df0e1-b97c-4d95-9af3-e66e324bcd94b3e14077-7c0d-4bcb-ab0e-0382e9d90570
has vulnerable target scope1 retained · stored CVE-2022-22965 → siemens · sinec_network_management_systemc35a4c04-37e3-46a0-8d35-3b0524edc7a6
has vulnerable target scope2 retained · stored CVE-2022-22965 → oracle · retail_merchandising_system9d092737-d552-44e2-957a-acda0f40b3909f80138a-7d6f-4fec-a51d-b2377f507729