CVE-2022-22965

Deeper analysis

CVE-2022-22965 is a remote code execution vulnerability affecting Spring MVC or Spring WebFlux applications running on JDK 9 or later. The flaw stems from unsafe data binding that permits attackers to manipulate class properties, leading to arbitrary code execution. The most direct exploit path requires the application to be deployed as a WAR on Tomcat; Spring Boot executable JAR deployments are not susceptible to the published attack vector, although the underlying issue is described as more general.

Unauthenticated remote attackers can exploit the vulnerability over the network to achieve full code execution, compromising confidentiality, integrity, and availability. Public proof-of-concept exploits have been released that target the data-binding mechanism in vulnerable configurations, enabling attackers to load and execute malicious classes without authentication or user interaction.

Vendor advisories from VMware Tanzu, Siemens, and SonicWall outline mitigation steps including framework upgrades and configuration changes to restrict data binding. The associated EPSS score remains elevated, with a current value of 0.9443 and a recorded peak of 0.9754, indicating sustained exploitation interest following disclosure. Public exploit code is available on PacketStorm.