Vulnerability Name:

CCN-220575

Published:2021-06-29
Updated:2021-06-29
Summary:Spring Framework could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in the SerializableTypeWrapper class. By sending specially-crafted input, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS v3 Severity:9.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
7.8 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.6 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Consequences:Gain Access
References:Source: XF
Type: UNKNOWN
spring-framework-code-exec(220575)

Source: CCN
Type: Spring Framework GIT Repository
MethodInvokeTypeProvider lazily invokes target method (avoiding deserialization exploits)

Source: CCN
Type: IBM Security Bulletin 6590823 (Common Licensing)
IBM Common Licensing is affected but not classified as vulnerable by a remote code execution in Spring Framework (220575,CVE-2022-22965)

Source: CCN
Type: IBM Security Bulletin 6841803 (Cognos Controller)
IBM Cognos Controller has addressed multiple vulnerabilities

Source: CCN
Type: WhiteSource Vulnerability Database
WS-2021-0170

Vulnerable Configuration:Configuration CCN 1:
  • cpe:/a:pivotal_software:spring_framework:4.1.8:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal_software:spring_framework:4.2.2:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:cognos_controller:10.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_controller:10.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_controller:10.4.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    pivotal_software spring framework 4.1.8
    pivotal_software spring framework 4.2.2
    ibm cognos controller 10.4.0
    ibm cognos controller 10.4.1
    ibm cognos controller 10.4.2