High 1 exploited CVE ICSA-22-286-05 2 CVEs

Hitachi Energy Lumada Asset Performance Management Prognostic Model Executor Service

Published Oct 13, 2022 · Updated Oct 13, 2022

Vendor: Hitachi Energy Product: Lumada Asset Performance Manager (APM)

Summary

Successful exploitation of these vulnerabilities could crash the Prognostic Model Executor and could allow remote code execution.

Vulnerabilities 2

Critical 9.8

CVE-2022-22965 Exploited Public exploit Scanner template EPSS 100%

Remote Code Execution in Spring Framework

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…

libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring-webflux Debian Ubuntu Maven

Apr 1, 2022
KEV Apr 4, 2022
Medium 6.5

CVE-2022-22950 EPSS 37%

Allocation of Resources Without Limits or Throttling in Spring Framework

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

libspring-java libspring-java org.springframework:spring-expression Debian Ubuntu Maven

Apr 1, 2022

Revision history

2022-10-13 #1
Publication Date

References

ICS Advisory ICSA-22-286-05 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-286-05
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/news-events/ics-advisories/icsa-22-286-05
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf