NewsSiemens ProductCERT

SSA-254054 V1.0: Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products

A vulnerability in Spring Framework was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2022-22965 and is also known as “Spring4Shell” or “SpringShell”. Siemens is currently investigating to determine which products are affected and is continuously updating this advisory as more information becomes available. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.

CVE-2022-22965VMware Spring Framework — Spring Framework JDK 9+ Remote Code Execution Vulnerability
CVE-2022-22965maven org.springframework.boot:spring-boot-starter-web: Code-Injection
CVE-2022-22965Siemens ProductCERT Advisory SSA-254054
CVE-2022-22965Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen
CVE-2022-22965Remote Code Execution in Spring Framework
CVE-2022-22965[Update] Zero-Day Vulnerability in Spring Framework

Affected vendors and products

Cisco Cisco CX Cloud Agent
Oracle Oracle Commerce Platform
Oracle Communications Cloud Native Core Automated Test Suite
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Unified Data Repository

Source: https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf

Linked advisories

Affected vendors and products