CVE-2022-22965 @ Maven-org.springframework:spring-beans-3.2.8.RELEASE

[dorohayon]

Vulnerable Package issue exists @ Maven-org.springframework:spring-beans-3.2.8.RELEASE in branch main

Spring Core is vulnerable to a severe remote code execution due to a bypass for CVE-2010-1622. Due to parameter binding, it is possible to access ClassLoader variables via POST parameters prefixed by class.module.classLoader.*. This was fixed in versions 5.2.20 and 5.3.18.

Namespace: dorohayon
Repository: cxone-advanced-lab
Repository Url: https://github.com/dorohayon/cxone-advanced-lab
CxAST-Project: dorohayon/cxone-advanced-lab
CxAST platform scan: 1f20cfdb-755f-4c85-8955-8edd4bc0421c
Branch: main
Application: cxone-advanced-lab
Severity: HIGH
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-94

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH
Remediation Upgrade Recommendation: 5.3.18

---

References
Advisory
Blog Post
POC/Exploit
Blog Post
Release Note
Issue
Commit
Disclosure
Advisory