{"cve_id":"CVE-2022-22965","published":"2022-04-01T23:15:13.870000+00:00","last_modified":"2026-06-17T04:29:15.610000+00:00","vuln_status":"Analyzed","description":"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","base_score":9.8,"base_severity":"CRITICAL","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"HIGH","impact_i":"HIGH","impact_a":"HIGH","cwe_ids":["CWE-94"],"in_kev":true,"kev_date_added":"2022-04-04","kev_ransomware":false,"epss_score":0.99638,"epss_percentile":0.9995,"cap_rule_version":"0.1.1","stage":"INITIAL_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"USER","caps":["CODE_EXEC"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T09:59:04.100714+00:00","first_seen":"2022-04-01T23:15:13.870000+00:00","kev_first_seen":"2022-04-04T00:00:00+00:00","novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["cisco","oracle","siemens","veritas","vmware"],"products":["access_appliance","commerce_platform","communications_cloud_native_core_automated_test_suite","communications_cloud_native_core_binding_support_function","communications_cloud_native_core_console","communications_cloud_native_core_network_exposure_function","communications_cloud_native_core_network_function_cloud_native_environment","communications_cloud_native_core_network_repository_function","communications_cloud_native_core_network_slice_selection_function","communications_cloud_native_core_policy","communications_cloud_native_core_security_edge_protection_proxy","communications_cloud_native_core_unified_data_repository","communications_policy_management","communications_unified_inventory_management","cx_cloud_agent","financial_services_analytical_applications_infrastructure","financial_services_behavior_detection_platform","financial_services_enterprise_case_management","flex_appliance","jdk","mysql_enterprise_monitor","netbackup_appliance","netbackup_flex_scale_appliance","netbackup_virtual_appliance","operation_scheduler","product_lifecycle_analytics","retail_bulk_data_integration","retail_customer_management_and_segmentation_foundation","retail_financial_integration","retail_integration_bus","retail_merchandising_system","retail_xstore_point_of_service","sd-wan_edge","simatic_speech_assistant_for_machines","sinec_network_management_system","sipass_integrated","siveillance_identity","spring_framework","weblogic_server"],"affected":[{"vendor":"cisco","product":"cx_cloud_agent","ranges":["< 2.1.0"]},{"vendor":"oracle","product":"commerce_platform","ranges":["11.3.2"]},{"vendor":"oracle","product":"communications_cloud_native_core_automated_test_suite","ranges":["1.9.0","22.1.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_binding_support_function","ranges":["22.1.3"]},{"vendor":"oracle","product":"communications_cloud_native_core_console","ranges":["22.1.0","1.9.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_network_exposure_function","ranges":["22.1.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_network_function_cloud_native_environment","ranges":["1.10.0","22.1.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_network_repository_function","ranges":["22.1.0","1.15.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_network_slice_selection_function","ranges":["1.15.0","1.8.0","22.1.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_policy","ranges":["1.15.0","22.1.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_security_edge_protection_proxy","ranges":["1.7.0","22.1.0"]},{"vendor":"oracle","product":"communications_cloud_native_core_unified_data_repository","ranges":["22.1.0","1.15.0"]},{"vendor":"oracle","product":"communications_policy_management","ranges":["12.6.0.0.0"]},{"vendor":"oracle","product":"communications_unified_inventory_management","ranges":["7.4.2","7.4.1","7.5.0"]},{"vendor":"oracle","product":"financial_services_analytical_applications_infrastructure","ranges":["8.1.2.0","8.1.1"]},{"vendor":"oracle","product":"financial_services_behavior_detection_platform","ranges":["8.1.2.0","8.1.1.0","8.1.1.1"]},{"vendor":"oracle","product":"financial_services_enterprise_case_management","ranges":["8.1.2.0","8.1.1.1","8.1.1.0"]},{"vendor":"oracle","product":"mysql_enterprise_monitor","ranges":["< 8.0.29"]},{"vendor":"oracle","product":"product_lifecycle_analytics","ranges":["3.6.1"]},{"vendor":"oracle","product":"retail_bulk_data_integration","ranges":["16.0.3"]},{"vendor":"oracle","product":"retail_customer_management_and_segmentation_foundation","ranges":["17.0","18.0","19.0"]},{"vendor":"oracle","product":"retail_financial_integration","ranges":["16.0.3","14.1.3.2","15.0.3.1","19.0.1"]},{"vendor":"oracle","product":"retail_integration_bus","ranges":["15.0.3.1","14.1.3.2","19.0.1","16.0.3"]},{"vendor":"oracle","product":"retail_merchandising_system","ranges":["19.0.1","16.0.3"]},{"vendor":"oracle","product":"retail_xstore_point_of_service","ranges":["21.0.0","20.0.1"]},{"vendor":"oracle","product":"sd-wan_edge","ranges":["9.0","9.1"]},{"vendor":"oracle","product":"weblogic_server","ranges":["14.1.1.0.0","12.2.1.4.0","12.2.1.3.0"]},{"vendor":"siemens","product":"operation_scheduler","ranges":["< 2.0.4"]},{"vendor":"siemens","product":"simatic_speech_assistant_for_machines","ranges":["< 1.2.1"]},{"vendor":"siemens","product":"sinec_network_management_system","ranges":["< 1.0.3"]},{"vendor":"siemens","product":"sipass_integrated","ranges":["2.85","2.80"]},{"vendor":"siemens","product":"siveillance_identity","ranges":["1.5","1.6"]},{"vendor":"veritas","product":"access_appliance","ranges":["7.4.3.100","7.4.3","7.4.3.200"]},{"vendor":"veritas","product":"flex_appliance","ranges":["2.0.2","2.0.1","1.3","2.0","2.1"]},{"vendor":"veritas","product":"netbackup_appliance","ranges":["4.0.0.1","4.0","4.1.0.1","4.1"]},{"vendor":"veritas","product":"netbackup_flex_scale_appliance","ranges":["2.1","3.0"]},{"vendor":"veritas","product":"netbackup_virtual_appliance","ranges":["4.1","4.0","4.1.0.1","4.0.0.1"]},{"vendor":"vmware","product":"spring_framework","ranges":["< 5.2.20","≥ 5.3.0 and < 5.3.18"]}]}