The remote host contains a Spring Framework library version that is prior to 5.2.20 or 5.3.x prior to 5.3.18. It is, therefore, affected by a remote code execution vulnerability:

  - A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via     data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application     is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the     nature of the vulnerability is more general, and there may be other ways to exploit it.

  - These are the prerequisites for the exploit:
    - JDK 9 or higher
    - Apache Tomcat as the Servlet container
    - Packaged as WAR
    - spring-webmvc or spring-webflux dependency

Note that users are required to enable the 'Show potential false alarms' setting, also known as paranoid mode, in their scan policy in order to enable this plugin in a scan. In addition, it is highly recommended to enable 'Perform thorough tests' setting to get the most accurate results.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Spring Framework < 5.2.20 / 5.3.x < 5.3.18 Remote Code Execution (CVE-2022-22965)

critical Nessus Plugin ID 159374