Summary
A vulnerability in Spring Framework was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2022-22965 and is also known as "Spring4Shell" or "SpringShell".
Siemens has released updates for the affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
Critical 9.8
Remote Code Execution in Spring Framework
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…
KEV Apr 4, 2022
Revision history
-
#4
Added fix for SINEC NMS
-
#3
Added affected products SIMATIC Speech Assistant for Machines (SAM) and SINEC NMS
-
#2
Added solution for Siveillance Identity
-
#1
Publication Date
References
-
SSA-254054: Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
-
SSA-254054: Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-254054.txt