---
title: "Security Vulnerability CVE-2022-22965 and CVE-2022-22963 (Spring4Shell Zero-Day Vulnerability)"
slug: "security-vulnerability-cve-2022-22965-and-cve-2022-22963-spring4shell-zero-day-vulnerability"
updated: 2022-04-12T06:05:57Z
published: 2022-04-12T06:05:57Z
canonical: "kb.ctera.com/security-vulnerability-cve-2022-22965-and-cve-2022-22963-spring4shell-zero-day-vulnerability"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.ctera.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Vulnerability CVE-2022-22965 and CVE-2022-22963 (Spring4Shell Zero-Day Vulnerability)

## **Vulnerability Description**

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment.

If the application is deployed as a Spring Boot executable jar, the default, it is not vulnerable to the exploit.

## **Vulnerability Details**

Publication Date: April 2022

Vulnerability Link: [![](https://nvd.nist.gov/site-media/images/favicons/favicon-16x16.png)NVD - CVE-2022-22965](https://nvd.nist.gov/vuln/detail/CVE-2022-22965) [![](https://nvd.nist.gov/site-media/images/favicons/favicon-16x16.png)NVD - CVE-2022-22963](https://nvd.nist.gov/vuln/detail/CVE-2022-22963)

NVD CVSS Score: Being evaluated

## **Affected CTERA Products**

- No CTERA products is affected.

#### **Analysis**

Both the CVE-2022-22965 and CVE-2022-22963 vulnerabilities are classified by CTERA as having **no** impact on CTERA products. Although the spring-core-2.5.6.jar is part of the CTERA Portal product, CTERA does not use Spring modules *MVC* or *Spring WebFlux* which potentially allow an attacker to send a specially crafted HTTP request to bypass protections via the Spring Core library of the HTTP request parser, leading to remote code execution.

#### **Workaround**

No workaround is required.

## **Related Articles**

[Vulnerability Remediation](/v1/docs/faq-3)