Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-22968

Quick assessment

Affected
n/a Spring Framework
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Vmware Spring Framework是美国威睿（Vmware）公司的一套开源的Java、JavaEE应用程序框架。该框架可帮助开发人员构建高质量的应用。 Vmware Spring Framework存在安全特征问题漏洞，该漏洞源于DataBinder上disallowedFields的模式是区分大小写的，这意味着字段没有得到有效保护，除非该字段的第一个字符同时以大写和小写字母列出，包括属性路径中所有嵌套字段的第一个字符的大写和小写字母。远程攻击者利用该漏洞可以绕过实施的安全限制。

AI Predicted 5.9 Difficulty: Easy EPSS 5.67% · P93
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-22968

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Vmware Spring Framework 安全特征问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vmware Spring Framework是美国威睿（Vmware）公司的一套开源的Java、JavaEE应用程序框架。该框架可帮助开发人员构建高质量的应用。 Vmware Spring Framework存在安全特征问题漏洞，该漏洞源于DataBinder上disallowedFields的模式是区分大小写的，这意味着字段没有得到有效保护，除非该字段的第一个字符同时以大写和小写字母列出，包括属性路径中所有嵌套字段的第一个字符的大写和小写字母。远程攻击者利用该漏洞可以绕过实施的安全限制。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- Spring Framework Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions -

II. Public POCs for CVE-2022-22968

# POC Description Source Link Shenlong Link
1 Testing CVE-2022-22968 https://github.com/MarcinGadz/spring-rce-poc POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-22968

请登录查看更多情报信息。

Vendor Advisories for CVE-2022-22968 (2)

Other References for CVE-2022-22968 (1)

Same Patch Batch · n/a · 2022-04-14 · 30 CVEs total

CVE-2022-27451 MariaDB 安全漏洞
CVE-2021-43287 ThoughtWorks GoCD 信息泄露漏洞
CVE-2022-26507 AT&T Labs Xmill 缓冲区错误漏洞
CVE-2021-43633 Messaging Web Application 跨站脚本漏洞
CVE-2021-43290 ThoughtWorks GoCD 路径遍历漏洞
CVE-2021-43289 ThoughtWorks GoCD 路径遍历漏洞
CVE-2021-43288 ThoughtWorks GoCD 跨站脚本漏洞
CVE-2021-43286 ThoughtWorks GoCD 命令注入漏洞
CVE-2022-27444 MariaDB 安全漏洞
CVE-2022-27445 MariaDB 安全漏洞
CVE-2022-27447 MariaDB 资源管理错误漏洞
CVE-2022-27446 MariaDB 安全漏洞
CVE-2022-27449 MariaDB 安全漏洞
CVE-2022-27448 MariaDB 安全漏洞
CVE-2022-27452 MariaDB 安全漏洞
CVE-2022-22966 VMware Cloud Director 输入验证错误漏洞
CVE-2022-27455 MariaDB 资源管理错误漏洞
CVE-2022-27457 MariaDB 资源管理错误漏洞
CVE-2022-27456 MariaDB 资源管理错误漏洞
CVE-2021-45228 COINS Construction Cloud 跨站脚本漏洞

Showing top 20 of 30 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Spring Framework
Same vendor: n/a

V. Comments for CVE-2022-22968

No comments yet

Leave a comment