Overview

An insecure version of the library from the Spring framework is used, which stores the following vulnerabilities:

RCE in Spring Core module (CVE-2022-22965) - Spring4Shell, Spring Framework 5.3.18 and 5.2.20 updates have been released to fix the vulnerability;
RCE in the Spring Cloud Function library (CVE-2022-22963) - the vulnerability is relevant for the library version up to 3.2.3;
Middle-level vulnerability that can cause a DoS condition (CVE-2022-22950) - affects Spring Framework versions 5.3.0 to 5.3.16.

Spring4Shell is an RCE vulnerability that allows an attacker to remotely execute malicious code. At the moment, it is classified as critical, with a rating of 9.8 according to the CVSS v3.0 system. The vulnerability affects Spring MVC and Spring WebFlux applications running Java Development Kit version 9 or later.

Config files : Spring Framework vulnerability

Classification

Overview

References

DerScanner Severity Score

Do you want to fix Config files : Spring Framework vulnerability in your application?

See also

Config files : Text4Shell Vulnerability

Config files : Incorrect directory deletion

Config files : Code injection