CVERadar
Edition used by more than 30,000 companies in more than 150 countries.
Sign Up For FreeCVE-2022-22965
Critical Severity|Vmware
94
SVRS
9.8
CVSSv3
0.94428
EPSS
TAGS
In The WildExploit AvaliableCISA KEVExploit Available
VECTOR STRING
CVSS:3.1AV:NAC:LPR:NUI:NS:UC:HI:HA:H
PUBLICATION DATE2022-04-01
LAST MODIFIED2025-10-21
Deep CVE Analysis in Progress
The system is currently conducting an in-depth analysis of the selected CVE. This includes advanced correlation, vulnerability classification, and cross-referencing with real-time threat intelligence sources. Once the analysis is complete, the page will automatically update with enriched vulnerability data and actionable insights.
Security Intelligence Brief
1. What is this vulnerability and why does it matter?
This is CVE-2022-22965, a Remote Code Execution (RCE) vulnerability affecting Spring MVC or Spring WebFlux applications. It stems from improper data binding when these applications are running on JDK 9+ and deployed on Tomcat as a WAR file. It matters significantly because RCE allows an attacker to execute arbitrary code on the affected system, potentially leading to full system compromise, data exfiltration, or denial of service.
2. What are the CVSS score, severity level, and disclosure details?
The CVSS score for this vulnerability is 9.8, which classifies it as a Critical severity level. The vulnerability was publicly disclosed and published on 2022-04-01 22:17:30. The record was last modified on 2025-10-21 23:15:42.
3. Which products, vendors, systems, and versions are affected?
This vulnerability affects:
- Products: Spring MVC applications and Spring WebFlux applications.
- Vendors: Spring (part of VMware/Broadcom).
- Systems: Applications running on JDK 9+ are potentially vulnerable. The specific exploit mentioned requires the application to be deployed on Tomcat as a WAR deployment. Applications deployed as a Spring Boot executable jar (the default deployment) are explicitly stated as not vulnerable to this specific exploit.
- Versions: Specific versions are not provided, but the context implies any Spring MVC or Spring WebFlux application running on JDK 9+ with the described deployment method.
4. What is the technical root cause and attack vector?
The technical root cause is identified as remote code execution (RCE) via data binding, categorized under CWE-94 (Improper Control of Generation of Code ('Code Injection')). The attack vector involves manipulating data binding processes within Spring MVC or Spring WebFlux applications. This typically involves sending specially crafted input that, when processed by the application's data binding mechanisms, can lead to the execution of attacker-controlled code.
5. How can this vulnerability be exploited?
This vulnerability can be exploited by an attacker leveraging data binding in a Spring MVC or Spring WebFlux application to achieve remote code execution. The primary, specific exploit vector mentioned requires the application to be deployed as a WAR file on Tomcat, while running on JDK 9+. While this specific deployment scenario is highlighted, the description also notes that "the nature of the vulnerability is more general, and there may be other ways to exploit it." Active exploits have been published, indicating that the methods for exploitation are publicly known and potentially automated.
7. How can vulnerable systems be detected?
Vulnerable systems can be detected by identifying applications that meet the following criteria:
- They are Spring MVC or Spring WebFlux applications.
- They are running on Java Development Kit (JDK) version 9 or higher.
- They are deployed specifically as a WAR (Web Application Archive) file on a Tomcat server.
10. What public intelligence references and advisories exist?
The primary public intelligence reference for this issue is CVE-2022-22965 itself. The existence of published active exploits implies that various cybersecurity advisories and security researcher reports are available detailing the vulnerability and its exploitation.
11. What is the risk assessment and urgency level?
The risk assessment for CVE-2022-22965 is Critical, indicated by its CVSS score of 9.8. This high score reflects the potential for Remote Code Execution (RCE), which is one of the most severe types of vulnerabilities. The urgency level is Immediate due to the critical nature of RCE and the explicit mention that "active exploits have been published to exploit the vulnerability." Organizations running affected configurations should prioritize patching or mitigation without delay.
Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNTCVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.