What is the CVSS severity score assigned to Spring4Shell?

Question

The Spring4Shell vulnerability, identified by CVE-2022-22965 and CVE-2022-22963, has been assigned a critical CVSS severity score of 9.8. This significant score underscores the extreme risk posed by this zero-day exploit affecting the widely-used Spring Framework, impacting both Spring Core and Spring Cloud Functions. The vulnerability allows for unauthenticated remote code execution, enabling attackers to gain unauthorized access and control over vulnerable servers.

Accepted Answer

Exploitation of Spring4Shell is contingent upon several specific conditions. These include the use of JDK 9 or higher, Apache Tomcat as the servlet container, and the application being packaged and deployed as a traditional WAR file rather than a Spring Boot executable jar. Furthermore, the presence of a spring-webmvc or spring-webflux dependency is required. The vulnerability specifically affects Spring Framework versions ranging from 5.3.0 to 5.3.17 and 5.2.0 to 5.2.19, as well as older, unsupported versions for CVE-2022-22965. For CVE-2022-22963, affected Spring Cloud Function versions include 3.1.6, 3.2.2, and older unsupported versions. It is important to recognize that the underlying nature of the vulnerability may allow for exploitation under other conditions as well, broadening its potential impact.

Reading history

Hide →

This history is cleared when the page is closed.

What is the CVSS severity score assigned to Spring4Shell?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

1

0

0

Share with friends