CVE-2022-22965: Spring4Shell
Code Injection: Is CVE-2022-22965 real, exploitable, or a false positive? Here's the community verdict.
signals
public sources
Confirmed exploited in the wild. Patch this first, regardless of the base score.
public exploits
links to sources — we don’t host codeA working exploit is publicly available from a maintained source. Treat this as higher urgency and verify your exposure.
baseline read
auto · not a community verdict
Real — exploited in the wild
CISA confirms active exploitation. Treat scanner hits as true positives unless your specific version or config is unaffected.
Based on CISA KEV
Confirm or dispute →CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
References
Published
Embed this verdict
[](https://www.truepositive.app/cve/CVE-2022-22965)<a href="https://www.truepositive.app/cve/CVE-2022-22965"><img src="https://www.truepositive.app/cve/CVE-2022-22965/badge.svg" alt="TruePositive verdict for CVE-2022-22965"></a>Live badge that updates automatically as the community verdict changes.
Community ground truth
Be the first practitioner to weigh in
So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.
🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.
In your experience, is this finding real and exploitable?
awaiting field verdictsCurated baseline: TruePositive's read from public sources is Real, needs specific conditions — a starting point, not a community verdict.
No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.
Field notes & remediation
Verdicts are the quick signal. Notes are the evidence and fixes behind them.
- 0
Real, but it has specific conditions, and many setups are not exploitable by the known method. It is a remote code execution bug in the Spring Framework. It abuses Spring's data binding to write a malicious file (a web shell) onto the server.
For the well-known exploit to work, several things must all be true. The app runs on JDK 9 or newer, it uses Spring MVC or WebFlux, it is deployed as a traditional WAR on Apache Tomcat, and it uses the affected data binding. A typical Spring Boot app packaged as an executable jar (with embedded Tomcat) is not exploitable by the public exploit. So a scanner flag does not always mean you are exploitable. Check how the app is deployed.
Do not confuse this with CVE-2022-22963 (Spring Cloud Function SpEL). They are two different bugs that came out around the same time.
Commonly flagged by: Trivy, Snyk, Dependabot.
- 0
Upgrade Spring Framework to 5.3.18+ or 5.2.20+ (and Spring Boot 2.6.6+ or 2.5.12+). If you cannot upgrade right away, the documented workaround is to block the dangerous fields in a ControllerAdvice (disallow class, module, and classLoader binding). But upgrading is the clean fix. After patching, check web-accessible folders for unexpected .jsp or .class files (dropped web shells).
Add a field note or remediationoptional
Related CVEs
Same weakness: CWE-94 · Code Injection.
- CVE-2015-1635CRIT 9.8KEVEPSS 100%
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
- CVE-2017-9841CRIT 9.8KEVEPSS 100%
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
- CVE-2022-22954CRIT 9.8KEVEPSS 100%
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
- CVE-2021-22204MED 6.8KEVEPSS 100%
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
- CVE-2012-0158HIGH 8.8KEVEPSS 100%
The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
- CVE-2022-22963CRIT 9.8KEVEPSS 100%
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.