CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2022-04-01
Spring Framework Remote Code Execution Vulnerability via Data Binding (Spring4Shell, CVE-2022-22965) Security Advisory
[Affected Scope] Spring MVC or Spring WebFlux applications running on JDK 9+ and deployed as a WAR on Apache Tomcat.
[Impact] Unauthenticated remote attackers can manipulate HTTP request parameters to modify Tomcat logging configurations and upload a web shell, leading to complete system compromise.
[Mitigation] Immediately upgrade Spring Framework to secure versions (5.3.18+, 5.2.20+) or update the corresponding Spring Boot parent version.