Spring Vulnerabilities CVE-2022-22963 and CVE-2022-22965

Beula_Climaxi · April 4, 2022, 10:26am

Hello UiPath team,

We have got the update regarding CVE-2022-22963 and CVE-2022-22965 vulnerability.
Could you please check and let us know if this impacts the following listed application? If yes, please let us know the next steps whether any patches released or any workaround has already been available for the vulnerability.
UiPath products Orchestrator, Insights, AI center, action center, task capture, orchestrator, studio.

StefanSchnell · April 4, 2022, 11:07am

CVE-2022-22963
Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources

CVE-2022-22965
Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding

Topic		Replies	Views
Impact Of The Following Vulnerabilities: CVE-2022-41903 And CVE-2022-23521 Knowledge Base orchestrator , 2022_4_0	0	289	August 8, 2023
Vulnerability found: CVE-2021-44043 Studio studio , feedback	1	1071	March 22, 2022
Log4j vulnerability CVE-2021-44832 on Orchestrator server Orchestrator orchestrator , question	1	980	April 29, 2022
Orchestrator Security And Vulnerabilities FAQs Knowledge Base orchestrator	0	503	May 3, 2023
Path traversal vulnerability found in OWASP ESAPI Impact in UiPath products Orchestrator 2, Insights, AI center, action center, task capture, orchestrator, studio Orchestrator orchestrator , studio , question , insights , task_capture , action_center	1	1062	May 6, 2022

Most Active Users - Yesterday
Anil_G
Quan.Mai
ashokkarale
sudster
Povilas_Jonikas
ijanszen1
Yoichi
dai_y
sven.wullum1
bhuvangates
More details...

Spring Vulnerabilities CVE-2022-22963 and CVE-2022-22965

Related Topics