40045—Spring4Shell

PUBLISHEDsecurity alertHigh

Active

Metadata

Alert ID:: 40045
Risk:: High
Type:: Active
CWE:: CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

The application appears to be vulnerable to CVE-2022-22965 (otherwise known as Spring4Shell) - remote code execution (RCE) via data binding.

Solution

Upgrade Spring Framework to versions 5.3.18, 5.2.20, or newer.

References

browse all alerts