CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

• Cisco Cx Cloud Agent

  APP
  Cisco
  < 2.1.0

• Oracle Commerce Platform

  APP
  Oracle
  11.3.2

• Oracle Communications Cloud Native Core Automated Test Suite

  APP
  Oracle
  1.9.022.1.0

• Oracle Communications Cloud Native Core Binding Support Function

  APP
  Oracle
  22.1.3

• Oracle Communications Cloud Native Core Console

  APP
  Oracle
  1.9.022.1.0

• Oracle Communications Cloud Native Core Network Exposure Function

  APP
  Oracle
  22.1.0

• Oracle Communications Cloud Native Core Network Function Cloud Native Environment

  APP
  Oracle
  1.10.022.1.0

• Oracle Communications Cloud Native Core Network Repository Function

  APP
  Oracle
  1.15.022.1.0

• Oracle Communications Cloud Native Core Network Slice Selection Function

  APP
  Oracle
  1.15.01.8.022.1.0

• Oracle Communications Cloud Native Core Policy

  APP
  Oracle
  1.15.022.1.0

• Oracle Communications Cloud Native Core Security Edge Protection Proxy

  APP
  Oracle
  1.7.022.1.0

• Oracle Communications Cloud Native Core Unified Data Repository

  APP
  Oracle
  1.15.022.1.0

• Oracle Communications Policy Management

  APP
  Oracle
  12.6.0.0.0

• Oracle Communications Unified Inventory Management

  APP
  Oracle
  7.4.17.4.27.5.0

• Oracle Financial Services Analytical Applications Infrastructure

  APP
  Oracle
  8.1.18.1.2.0

• Oracle Financial Services Behavior Detection Platform

  APP
  Oracle
  8.1.1.08.1.1.18.1.2.0

• Oracle Financial Services Enterprise Case Management

  APP
  Oracle
  8.1.1.08.1.1.18.1.2.0

• Oracle JDK

  APP
  Oracle
  ≥ 9

• Oracle MySQL Enterprise Monitor

  APP
  Oracle
  < 8.0.29

• Oracle Product Lifecycle Analytics

  APP
  Oracle
  3.6.1

• Oracle Retail Bulk Data Integration

  APP
  Oracle
  16.0.3

• Oracle Retail Customer Management And Segmentation Foundation

  APP
  Oracle
  17.018.019.0

• Oracle Retail Financial Integration

  APP
  Oracle
  14.1.3.215.0.3.116.0.319.0.1

• Oracle Retail Integration Bus

  APP
  Oracle
  14.1.3.215.0.3.116.0.319.0.1

• Oracle Retail Merchandising System

  APP
  Oracle
  16.0.319.0.1

• Oracle Retail Xstore Point Of Service

  APP
  Oracle
  20.0.121.0.0

• Oracle Sd Wan Edge

  APP
  Oracle
  9.09.1

• Oracle Weblogic Server

  APP
  Oracle
  12.2.1.3.012.2.1.4.014.1.1.0.0

• Siemens Operation Scheduler

  APP
  Siemens
  < 2.0.4

• Siemens Simatic Speech Assistant For Machines

  APP
  Siemens
  < 1.2.1