CVE-2022-22965 in vmware spring framework
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Affected software: vmware spring framework, cisco cx cloud agent, oracle communications cloud native core automated test suite, oracle communications cloud native core console, oracle communications cloud native core network exposure function, oracle communications cloud native core network function cloud native environment, oracle communications cloud native core network repository function, oracle communications cloud native core network slice selection function, oracle communications cloud native core policy, oracle communications cloud native core security edge protection proxy
Scores
- CVSS: 9.8 (critical)
- EPSS: 99.64% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2022-04-04
- Published: 2022-04-01
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): Yes, published
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.