{"metadata": {"vulnerability": "CVE-2022-22965", "count": 654, "kinds": {"milestone": 32, "sighting": 320, "kev": 17, "other": 285}}, "data": [{"timestamp": "2022-01-10T00:00:00Z", "date_only": false, "value": "2022-01-10T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2022-22965", "field": "cveMetadata.dateReserved"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_release_date.data.10.date"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2022:1306", "record": "RHSA-2022:1306", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2022:1333", "record": "RHSA-2022:1333", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2022:1360", "record": "RHSA-2022:1360", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2022:1378", "record": "RHSA-2022:1378", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2022:1379", "record": "RHSA-2022:1379", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2022:1626", "record": "RHSA-2022:1626", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2022:1627", "record": "RHSA-2022:1627", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2022_1306", "record": "RHSA-2022_1306", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2022_1333", "record": "RHSA-2022_1333", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2022_1360", "record": "RHSA-2022_1360", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2022_1378", "record": "RHSA-2022_1378", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2022_1379", "record": "RHSA-2022_1379", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2022_1626", "record": "RHSA-2022_1626", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-30T00:00:00Z", "date_only": false, "value": "2022-03-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2022_1627", "record": "RHSA-2022_1627", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-30T22:00:00Z", "date_only": false, "value": "2022-03-30T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-03-30T22:00:00Z", "date_only": false, "value": "2022-03-30T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-03-30T22:00:00Z", "date_only": false, "value": "2022-03-30T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": true, "value": "2022-03-31", "kind": "other", "label": "Date", "source": "gsd \u00b7 GSD-2022-22965", "record": "GSD-2022-22965", "field": "namespaces.gitlab.com.advisories.0.date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_release_date.data.0.date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2022:1306", "record": "RHSA-2022:1306", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2022:1333", "record": "RHSA-2022:1333", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2022:1360", "record": "RHSA-2022:1360", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2022:1378", "record": "RHSA-2022:1378", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2022:1379", "record": "RHSA-2022:1379", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2022:1626", "record": "RHSA-2022:1626", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2022:1627", "record": "RHSA-2022:1627", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2022_1306", "record": "RHSA-2022_1306", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2022_1333", "record": "RHSA-2022_1333", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2022_1360", "record": "RHSA-2022_1360", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2022_1378", "record": "RHSA-2022_1378", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2022_1379", "record": "RHSA-2022_1379", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2022_1626", "record": "RHSA-2022_1626", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2022_1627", "record": "RHSA-2022_1627", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": true, "value": "2022-03-31", "kind": "other", "label": "Pubdate", "source": "gsd \u00b7 GSD-2022-22965", "record": "GSD-2022-22965", "field": "namespaces.gitlab.com.advisories.0.pubdate"}, {"timestamp": "2022-03-31T00:00:00Z", "date_only": false, "value": "2022-03-31T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-297", "record": "CERTFR-2022-AVI-297", "field": "revisions.0.revision_date"}, {"timestamp": "2022-03-31T13:45:50Z", "date_only": false, "value": "2022-03-31T13:45:50.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1756", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "d9cf2f07-2f7f-4ae9-9822-c6f3b7150a2f", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-22965 : about spring core rce\nURL\uff1ahttps://github.com/Mr-xn/spring-core-rce\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1756"}, {"timestamp": "2022-03-31T14:20:55Z", "date_only": false, "value": "2022-03-31T14:20:55.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1757", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "521c2c51-5a74-40b8-87b3-311f514e66cb", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aspring-core\u5355\u4e2a\u56fe\u5f62\u5316\u5229\u7528\u5de5\u5177\uff0cCVE-2022-22965\u53ca\u4fee\u590d\u65b9\u6848\u5df2\u51fa\nURL\uff1ahttps://github.com/light-Life/CVE-2022-22965-GUItools\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1757"}, {"timestamp": "2022-03-31T14:38:31Z", "date_only": false, "value": "2022-03-31T14:38:31.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1759", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "fd69b03f-1a24-44c8-ba6e-9d0c9b039b7a", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-22965 - CVE-2010-1622 redux\nURL\uff1ahttps://github.com/DDuarte/springshell-rce-poc\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1759"}, {"timestamp": "2022-03-31T17:11:31Z", "date_only": false, "value": "2022-03-31T17:11:31.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityIL_Chat/11315", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "6b0f3c85-e020-46e2-ae26-1f83b5168ba0", "content": "https://tanzu.vmware.com/security/cve-2022-22965", "url": "https://t.me/CyberSecurityIL_Chat/11315"}, {"timestamp": "2022-03-31T17:19:03Z", "date_only": false, "value": "2022-03-31T17:19:03.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1760", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "e36b49eb-17c3-4374-a0de-00bd5c9deffc", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aA Safer PoC for CVE-2022-22965 (Spring4Shell)\nURL\uff1ahttps://github.com/colincowie/Safer_PoC_CVE-2022-22965\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1760"}, {"timestamp": "2022-03-31T17:37:33Z", "date_only": false, "value": "2022-03-31T17:37:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/2034", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "890a1385-ed52-4479-a2e7-9a2986a29384", "content": "Important \u2014 Spring Framework maintainers have released an emergency patch to address a newly disclosed RCE vulnerability (CVE-2022-22965) that could allow unauthenticated attackers to take control of targeted systems.\n\nDetails: https://thehackernews.com/2022/03/security-patch-releases-for-critical.html", "url": "https://t.me/thehackernews/2034"}, {"timestamp": "2022-03-31T18:30:50Z", "date_only": false, "value": "2022-03-31T18:30:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-36P3-WJMG-H94X", "record": "GHSA-36P3-WJMG-H94X", "field": "published"}, {"timestamp": "2022-03-31T18:55:44Z", "date_only": false, "value": "2022-03-31T18:55:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1761", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "adf1d761-ed12-47ce-9218-a19fb7d6607e", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aSpring4Shell Proof Of Concept/Information CVE-2022-22965\nURL\uff1ahttps://github.com/BobTheShoplifter/Spring4Shell-POC\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1761"}, {"timestamp": "2022-03-31T19:20:12Z", "date_only": false, "value": "2022-03-31T19:20:12.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1762", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "4a4e48ee-c3b6-4329-917f-77fddb86e400", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aDockerized Spring4Shell (CVE-2022-22965) PoC application and exploit\nURL\uff1ahttps://github.com/reznok/Spring4Shell-POC\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1762"}, {"timestamp": "2022-03-31T19:25:03Z", "date_only": false, "value": "2022-03-31T19:25:03.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1763", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "9bf30ea1-d943-439d-b34e-8b1fc190d1d0", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-22965 poc including reverse-shell support\nURL\uff1ahttps://github.com/viniciuspereiras/CVE-2022-22965-poc\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1763"}, {"timestamp": "2022-03-31T21:02:25Z", "date_only": false, "value": "2022-03-31T21:02:25.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1764", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "0c69e7ab-d3f9-4884-8da7-8822942a496b", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aThis includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed \\\"SpringShell\\\".\nURL\uff1ahttps://github.com/kh4sh3i/Spring-CVE\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1764"}, {"timestamp": "2022-03-31T21:29:30Z", "date_only": false, "value": "2022-03-31T21:29:30.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cKure/9233", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "712342ad-cedc-4dc4-9517-412742e7c7cd", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 Spring4Shell: Zero-Day Vulnerability in Spring Framework (CVE-2022-22965).\n\nhttps://www.rapid7.com/blog/post/2022/03/30/spring4shell-zero-day-vulnerability-in-spring-framework/", "url": "https://t.me/cKure/9233"}, {"timestamp": "2022-03-31T22:00:00Z", "date_only": false, "value": "2022-03-31T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2022-04-01T00:00:00Z", "date_only": false, "value": "2022-04-01T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_release_date.data.1.date"}, {"timestamp": "2022-04-01T00:51:08Z", "date_only": false, "value": "2022-04-01T00:51:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1765", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "febf5323-cade-4b33-997a-4b7944e6cedf", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aSpring4Shell - Spring Core RCE - CVE-2022-22965\nURL\uff1ahttps://github.com/mebibite/springhound\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1765"}, {"timestamp": "2022-04-01T02:38:06Z", "date_only": false, "value": "2022-04-01T02:38:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1766", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "24492407-dcf8-48b2-bd09-5badf5f76f93", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-22965 EXP\nURL\uff1ahttps://github.com/likewhite/CVE-2022-22965\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1766"}, {"timestamp": "2022-04-01T04:00:00Z", "date_only": false, "value": "2022-04-01T04:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=767", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "f92d6562-598f-4cbf-b835-39d2a6895082", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=767"}, {"timestamp": "2022-04-01T04:21:47Z", "date_only": false, "value": "2022-04-01T04:21:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1775", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "cd82d0cd-6be8-4962-9d91-f480f311da71", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aSpringFramework \u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1eCVE-2022-22965\nURL\uff1ahttps://github.com/Axx8/SpringFramework_RCE_CVE-2022-22965\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1775"}, {"timestamp": "2022-04-01T04:57:57Z", "date_only": false, "value": "2022-04-01T04:57:57.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1776", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "3dcbf479-881f-4fe1-8ad9-29f2ee2f85a6", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aSpringFramework \u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1eCVE-2022-22965\nURL\uff1ahttps://github.com/Axx8/SpringFramework_CVE-2022-22965_RCE\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1776"}, {"timestamp": "2022-04-01T06:53:51Z", "date_only": false, "value": "2022-04-01T06:53:51.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1778", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "59bd43b3-1747-4013-9f58-a43180ded5c6", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aSpring-0day/CVE-2022-22965\nURL\uff1ahttps://github.com/nu0l/CVE-2022-22965\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1778"}, {"timestamp": "2022-04-01T07:06:02Z", "date_only": false, "value": "2022-04-01T07:06:02.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1780", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "4256901a-027a-48d9-8c48-ea18baee3ffe", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aPython Script for exploiting CVE-2022-22965\nURL\uff1ahttps://github.com/0xbughunter/Spring4Shell-Exploit-PoC-\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1780"}, {"timestamp": "2022-04-01T07:12:39Z", "date_only": false, "value": "2022-04-01T07:12:39.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1781", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "c5e9bf70-c335-4630-a945-8e3fab39c27d", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aPython Script for exploiting CVE-2022-22965\nURL\uff1ahttps://github.com/0xbughunter/Spring4Shell-Exploit-PoC\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1781"}, {"timestamp": "2022-04-01T08:39:21Z", "date_only": false, "value": "2022-04-01T08:39:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1786", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "5203f170-10e2-415e-8e90-cbc402800579", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-22965 spring-core\u6279\u91cf\u68c0\u6d4b\u811a\u672c\nURL\uff1ahttps://github.com/chaosec2021/CVE-2022-22965-POC\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1786"}, {"timestamp": "2022-04-01T10:36:57Z", "date_only": false, "value": "2022-04-01T10:36:57.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1862", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "545a44c7-4b49-4288-9ba7-35f09c210275", "content": "#CVE-2022\n\nA Safer PoC for CVE-2022-22965 (Spring4Shell)\n\nhttps://github.com/colincowie/Safer_PoC_CVE-2022-22965\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1862"}, {"timestamp": "2022-04-01T10:38:56Z", "date_only": false, "value": "2022-04-01T10:38:56.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1863", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "284a066f-42ac-4c4d-bc8a-82321c1fcdb6", "content": "Spring4Shell Proof Of Concept/Information CVE-2022-22965\n\nhttps://github.com/BobTheShoplifter/Spring4Shell-POC\n\n#CVE\n@BlackSeaHackBot", "url": "https://t.me/BlueRedTeam/1863"}, {"timestamp": "2022-04-01T10:41:14Z", "date_only": false, "value": "2022-04-01T10:41:14.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1864", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "1785ecbb-1992-4d67-8f1a-46a5e85a2534", "content": "#CVE-2022\n\nSpring4Shell Proof Of Concept/Information CVE-2022-22965\n\nhttps://github.com/BobTheShoplifter/Spring4Shell-POC\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1864"}, {"timestamp": "2022-04-01T10:46:27Z", "date_only": false, "value": "2022-04-01T10:46:27.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1865", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "b66dbea5-13b8-4178-9ae8-c554f2ae9057", "content": "#CVE-2022\n\nDockerized Spring4Shell (CVE-2022-22965) PoC application and exploit\n\nhttps://github.com/reznok/Spring4Shell-POC\n\n#CVE\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1865"}, {"timestamp": "2022-04-01T10:47:46Z", "date_only": false, "value": "2022-04-01T10:47:46.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1866", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "6cd46b0b-f13d-45a8-bdeb-aa7a18a93c46", "content": "#CVE-2022\n\nCVE-2022-22965 poc including reverse-shell support\n\nhttps://github.com/viniciuspereiras/CVE-2022-22965-poc\n\n#CVE\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1866"}, {"timestamp": "2022-04-01T10:49:48Z", "date_only": false, "value": "2022-04-01T10:49:48.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1867", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "e5f7ee31-5166-40c4-9596-dfe5c52cfa1a", "content": "#CVE-2022\n\nThis includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed \\\"SpringShell\\\".\n\nhttps://github.com/kh4sh3i/Spring-CVE\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1867"}, {"timestamp": "2022-04-01T10:53:53Z", "date_only": false, "value": "2022-04-01T10:53:53.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1868", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "20c8a1b4-e409-41d1-b031-02c2812ad478", "content": "#CVE-2022\n\nSpring4Shell - Spring Core RCE - CVE-2022-22965\n\nhttps://github.com/mebibite/springhound\n\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1868"}, {"timestamp": "2022-04-01T10:56:57Z", "date_only": false, "value": "2022-04-01T10:56:57.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1869", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "3c376245-b0fb-4a6e-b19d-a0027d823d1e", "content": "#CVE-2022\n\nSpring-0day/CVE-2022-22965\n\nhttps://github.com/nu0l/CVE-2022-22965\n\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1869"}, {"timestamp": "2022-04-01T11:00:59Z", "date_only": false, "value": "2022-04-01T11:00:59.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1870", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "52a91ec7-48e8-4f5f-b0c4-9fce110e52b1", "content": "#CVE-2022\n\nPython Script for exploiting CVE-2022-22965\n\nhttps://github.com/0xbughunter/Spring4Shell-Exploit-PoC-\n\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1870"}, {"timestamp": "2022-04-01T12:26:43Z", "date_only": false, "value": "2022-04-01T12:26:43.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1798", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "fceb1403-c6da-45a9-bdcc-eb05938f2262", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-22965 Environment\nURL\uff1ahttps://github.com/Joe1sn/CVE-2022-22965\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1798"}, {"timestamp": "2022-04-01T14:04:23Z", "date_only": false, "value": "2022-04-01T14:04:23.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1803", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "e8979951-4275-4635-8cd9-1c43b1d74d8e", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-22965\nURL\uff1ahttps://github.com/wshon/spring-framework-rce\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1803"}, {"timestamp": "2022-04-01T22:17:30Z", "date_only": false, "value": "2022-04-01T22:17:30.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2022-22965", "field": "cveMetadata.datePublished"}, {"timestamp": "2022-04-01T23:15:00Z", "date_only": false, "value": "2022-04-01T23:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-36P3-WJMG-H94X", "record": "GHSA-36P3-WJMG-H94X", "field": "database_specific.nvd_published_at"}, {"timestamp": "2022-04-01T23:15:00Z", "date_only": false, "value": "2022-04-01T23:15:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2022-22965", "record": "UBUNTU-CVE-2022-22965", "field": "published"}, {"timestamp": "2022-04-01T23:15:00Z", "date_only": false, "value": "2022-04-01T23:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2022-22965", "record": "GSD-2022-22965", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2022-04-01T23:15:13.870Z", "date_only": false, "value": "2022-04-01T23:15:13.870000", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_release_date.data.12.date"}, {"timestamp": "2022-04-01T23:15:13.870Z", "date_only": false, "value": "2022-04-01T23:15:13.870", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-22965", "record": "FKIE_CVE-2022-22965", "field": "published"}, {"timestamp": "2022-04-01T23:45:00Z", "date_only": false, "value": "2022-04-01T23:45:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-01T23:45:00Z", "date_only": false, "value": "2022-04-01T23:45:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-04-02T00:00:00Z", "date_only": false, "value": "2022-04-02T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_update_date.data.3.date"}, {"timestamp": "2022-04-02T00:37:17Z", "date_only": false, "value": "2022-04-02T00:37:17+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-02T03:55:08Z", "date_only": false, "value": "2022-04-02T03:55:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1817", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "b289ba32-7fb8-4b1b-a2b5-e8ec510e340b", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-22965 POC\nURL\uff1ahttps://github.com/Wrin9/CVE-2022-22965\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1817"}, {"timestamp": "2022-04-02T07:43:42Z", "date_only": false, "value": "2022-04-02T07:43:42.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/google/tsunami-security-scanner-plugins/tree/master/community/detectors/spring_framework_cve_2022_22965", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "f2dd6700-2a90-4e6c-9e8a-327fcbf61264", "url": "https://github.com/google/tsunami-security-scanner-plugins/tree/master/community/detectors/spring_framework_cve_2022_22965"}, {"timestamp": "2022-04-02T09:56:16Z", "date_only": false, "value": "2022-04-02T09:56:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1820", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "b2f48580-882a-4f39-8975-7647272b147c", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1a\u6f0f\u6d1eEXP\n\u63cf\u8ff0\uff1aCVE-2022-22965\\\\Spring-Core-RCE\u582a\u6bd4\u5173\u4e8e Apache Log4j2\u6838\u5f39\u7ea7\u522b\u6f0f\u6d1eexp\u7684rce\u4e00\u952e\u5229\u7528\nURL\uff1ahttps://github.com/wjl110/CVE-2022-22965-Spring-Core-RCE.\n\n\u6807\u7b7e\uff1a#\u6f0f\u6d1eEXP", "url": "https://t.me/GithubRedTeam/1820"}, {"timestamp": "2022-04-02T10:21:15Z", "date_only": false, "value": "2022-04-02T10:21:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1821", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "fac1cfb5-0922-45f5-b23e-37e748ed9ff2", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1a\u6f0f\u6d1eEXP\n\u63cf\u8ff0\uff1aCVE-2022-22965\\\\Spring-Core-RCE\u582a\u6bd4\u5173\u4e8e Apache Log4j2\u6838\u5f39\u7ea7\u522b\u6f0f\u6d1eexp\u7684rce\u4e00\u952e\u5229\u7528\nURL\uff1ahttps://github.com/wjl110/CVE-2022-22965_Spring_Core_RCE\n\n\u6807\u7b7e\uff1a#\u6f0f\u6d1eEXP", "url": "https://t.me/GithubRedTeam/1821"}, {"timestamp": "2022-04-02T10:27:02Z", "date_only": false, "value": "2022-04-02T10:27:02.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1882", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "1c70000f-fe60-4ea6-9657-6aa0acc5639b", "content": "#exploit\n1. 2 Click RCE in Evernote Android\nhttps://hackerone.com/reports/1377748\n\n2. CVE-2022-22965:\nSpring Framework RCE\nhttps://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement\n]-> https://github.com/DDuarte/springshell-rce-poc\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1882"}, {"timestamp": "2022-04-02T13:12:01Z", "date_only": false, "value": "2022-04-02T13:12:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/5726", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "d76fa0cd-bb29-477e-8c9d-761c37e07386", "content": "#exploit\n1. 2 Click RCE in Evernote Android\nhttps://hackerone.com/reports/1377748\n\n2. CVE-2022-22965:\nSpring Framework RCE\nhttps://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement\n]-> https://github.com/DDuarte/springshell-rce-poc", "url": "https://t.me/CyberSecurityTechnologies/5726"}, {"timestamp": "2022-04-02T13:57:25Z", "date_only": false, "value": "2022-04-02T13:57:25.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1824", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "67da42f2-5ad2-4ffa-b08a-572b6fa6f864", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-22965\\\\Spring-Core-RCE\u582a\u6bd4\u5173\u4e8e Apache Log4j2\u6838\u5f39\u7ea7\u522b\u6f0f\u6d1eexp\u7684rce\u4e00\u952e\u5229\u7528\nURL\uff1ahttps://github.com/drapl0n/dirtypipe\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1824"}, {"timestamp": "2022-04-03T06:42:30Z", "date_only": false, "value": "2022-04-03T06:42:30.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1830", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "4585c653-6abb-4f96-a992-ecef022d4a68", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aDocker PoC for CVE-2022-22965 with Spring Boot version 2.6.5\nURL\uff1ahttps://github.com/itsecurityco/CVE-\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1830"}, {"timestamp": "2022-04-03T08:44:06Z", "date_only": false, "value": "2022-04-03T08:44:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1832", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "1a65c4bd-7c5f-4bb2-b49e-09a4191956cd", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aDocker PoC for CVE-2022-22965 with Spring Boot version 2.6.5\nURL\uff1ahttps://github.com/itsecurityco/CVE-2022-22965\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1832"}, {"timestamp": "2022-04-03T22:00:00Z", "date_only": false, "value": "2022-04-03T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2022-22965", "field": "timestamps.asserted_at", "uuid": "c7e9e0be-415b-432d-87ef-47f41a518a9d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2022-22965", "field": "timestamps.asserted_at", "uuid": "469517cb-a93b-49b4-a3ba-a983b4db382a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": true, "value": "2022-04-04", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-22965", "field": "containers.adp.1.metrics.2.other.content.dateAdded"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": true, "value": "2022-04-04", "kind": "other", "label": "Catalog added", "source": "gsd \u00b7 GSD-2022-22965", "record": "GSD-2022-22965", "field": "namespaces.cisa.gov.dateAdded"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2022-22965", "field": "evidence.0.details.added_date", "uuid": "469517cb-a93b-49b4-a3ba-a983b4db382a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022:1306", "record": "RHSA-2022:1306", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022:1333", "record": "RHSA-2022:1333", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022:1360", "record": "RHSA-2022:1360", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022:1378", "record": "RHSA-2022:1378", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022:1379", "record": "RHSA-2022:1379", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022:1626", "record": "RHSA-2022:1626", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022:1627", "record": "RHSA-2022:1627", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022_1306", "record": "RHSA-2022_1306", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022_1333", "record": "RHSA-2022_1333", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022_1360", "record": "RHSA-2022_1360", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022_1378", "record": "RHSA-2022_1378", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022_1379", "record": "RHSA-2022_1379", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022_1626", "record": "RHSA-2022_1626", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022_1627", "record": "RHSA-2022_1627", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": true, "value": "2022-04-04", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2022-22965", "field": "evidence.0.details.date_added", "uuid": "c7e9e0be-415b-432d-87ef-47f41a518a9d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2022-22965", "field": "timestamps.first_seen_at", "uuid": "c7e9e0be-415b-432d-87ef-47f41a518a9d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2022-22965", "field": "timestamps.first_seen_at", "uuid": "469517cb-a93b-49b4-a3ba-a983b4db382a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-307", "record": "CERTFR-2022-AVI-307", "field": "revisions.0.revision_date"}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2022-22965", "field": "status.status_updated_at", "uuid": "c7e9e0be-415b-432d-87ef-47f41a518a9d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2022-22965", "field": "status.status_updated_at", "uuid": "469517cb-a93b-49b4-a3ba-a983b4db382a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-04-04T00:00:00Z", "date_only": false, "value": "2022-04-04T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-22965", "field": "containers.adp.1.timeline.0.time"}, {"timestamp": "2022-04-04T01:24:15Z", "date_only": false, "value": "2022-04-04T01:24:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1840", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "e3b6cce4-dcca-4d9e-ab4b-de59f0a050bd", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aSpring Framework RCE via Data Binding on JDK 9+ / spring4shell / CVE-2022-22965\nURL\uff1ahttps://github.com/me2nuk/CVE-2022-22965\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1840"}, {"timestamp": "2022-04-04T03:29:20Z", "date_only": false, "value": "2022-04-04T03:29:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1891", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "88bac3eb-48f4-4d6e-b09d-f78b6d3366fd", "content": "#CVE-2022\n\nSpring Framework RCE via Data Binding on JDK 9+ / spring4shell / CVE-2022-22965\n\nhttps://github.com/me2nuk/CVE-2022-22965\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1891"}, {"timestamp": "2022-04-04T04:00:00Z", "date_only": false, "value": "2022-04-04T04:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=770", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "05b1cd69-4b21-40a6-ad82-0c8da52befd4", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=770"}, {"timestamp": "2022-04-04T05:25:16Z", "date_only": false, "value": "2022-04-04T05:25:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1841", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "fb6204c9-7a88-4b57-96c0-930ac1bef8eb", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aNmap Spring4Shell NSE script for Spring Boot RCE (CVE-2022-22965) \nURL\uff1ahttps://github.com/gpiechnik2/nmap-spring4shell\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1841"}, {"timestamp": "2022-04-04T10:42:28Z", "date_only": false, "value": "2022-04-04T10:42:28.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1846", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "5a0923f3-5961-4dff-9887-7b10c16c1c63", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aPowerShell port of CVE-2022-22965 vulnerability check by colincowie.\nURL\uff1ahttps://github.com/daniel0x00/Invoke-CVE-2022-22965-SafeCheck\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1846"}, {"timestamp": "2022-04-04T11:59:36Z", "date_only": false, "value": "2022-04-04T11:59:36.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1893", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "da4e6f94-519a-4950-b308-91b898bce85d", "content": "#CVE-2022\n\nNmap Spring4Shell NSE script for Spring Boot RCE (CVE-2022-22965) \n\nhttps://github.com/gpiechnik2/nmap-spring4shell\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1893"}, {"timestamp": "2022-04-04T14:04:15Z", "date_only": false, "value": "2022-04-04T14:04:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1847", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "e399f0e6-58e1-4407-90b2-b4c0c8b45fbb", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aIntentionally vulnerable Spring app to test CVE-2022-22965\nURL\uff1ahttps://github.com/fracturelabs/spring4shell_victim\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1847"}, {"timestamp": "2022-04-04T16:19:21Z", "date_only": false, "value": "2022-04-04T16:19:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1849", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "2154d100-673e-4005-8049-f791542d3b5c", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-22965 (Spring4Shell) Proof of Concept\nURL\uff1ahttps://github.com/sunnyvale-it/CVE-2022-22965-PoC\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1849"}, {"timestamp": "2022-04-04T16:47:57Z", "date_only": false, "value": "2022-04-04T16:47:57.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1850", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "46055531-d6af-4d22-970a-6cf261fb113d", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aSpring4Shell - CVE-2022-22965\nURL\uff1ahttps://github.com/twseptian/cve-2022-22965\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1850"}, {"timestamp": "2022-04-04T17:37:02Z", "date_only": false, "value": "2022-04-04T17:37:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/49661", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "dcd8a7f2-b77b-45f7-9e67-c4614f93ae59", "content": "Spring4Shell (CVE-2022-22965): details and mitigations\n\nhttps://ift.tt/JZjNE2p", "url": "https://t.me/ctinow/49661"}, {"timestamp": "2022-04-04T17:41:32Z", "date_only": false, "value": "2022-04-04T17:41:32.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/49662", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "ec0f0b00-df51-4c13-8116-c1c4fa3e85c7", "content": "Spring4Shell (CVE-2022-22965): details and mitigations\n\nhttps://ift.tt/JZjNE2p", "url": "https://t.me/ctinow/49662"}, {"timestamp": "2022-04-04T19:18:05Z", "date_only": false, "value": "2022-04-04T19:18:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1895", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "0ab359d5-cc85-4301-8c6d-ba0969d2d680", "content": "#CVE-2022\n\nPowerShell port of CVE-2022-22965 vulnerability check by colincowie.\n\nhttps://github.com/daniel0x00/Invoke-CVE-2022-22965-SafeCheck\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1895"}, {"timestamp": "2022-04-04T21:10:13Z", "date_only": false, "value": "2022-04-04T21:10:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1853", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "315dbae9-8401-42a5-a937-f471a8255d85", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aVulnerability scanner for Spring4Shell (CVE-2022-22965)\nURL\uff1ahttps://github.com/fracturelabs/go-scan-spring\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1853"}, {"timestamp": "2022-04-04T21:57:16Z", "date_only": false, "value": "2022-04-04T21:57:16+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2022-04-04T22:00:00Z", "date_only": false, "value": "2022-04-04T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2022-04-05T01:00:42Z", "date_only": false, "value": "2022-04-05T01:00:42.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1896", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "69a13c91-3986-4888-a596-4fb7ee4e1a3e", "content": "#CVE-2022\n\nVulnerability scanner for Spring4Shell (CVE-2022-22965)\n\nhttps://github.com/fracturelabs/go-scan-spring\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1896"}, {"timestamp": "2022-04-05T03:16:14Z", "date_only": false, "value": "2022-04-05T03:16:14.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/49690", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "83dd41db-f396-41d5-9f88-eceec4499d28", "content": "SpringShell RCE vulnerability: Guidance for protecting against and detecting CVE-2022-22965\n\nhttps://ift.tt/rIi4Ome", "url": "https://t.me/ctinow/49690"}, {"timestamp": "2022-04-05T05:00:00Z", "date_only": false, "value": "2022-04-05T05:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://msrc.microsoft.com/blog/2022/04/microsofts-response-to-cve-2022-22965-spring-framework/", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "68227531-f733-4594-a2a8-a108885155d3", "url": "https://msrc.microsoft.com/blog/2022/04/microsofts-response-to-cve-2022-22965-spring-framework/"}, {"timestamp": "2022-04-05T09:43:20Z", "date_only": false, "value": "2022-04-05T09:43:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1861", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "d6c57939-5d7b-4b06-92a4-98692f0ee089", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aSpring has Confirmed the RCE in Spring Framework. The team has just published the statement along with the mitigation guides for the issue. Now, this vulnerability can be tracked as CVE-2022-22965.\nURL\uff1ahttps://github.com/Snip3R69/spring-shell-vuln\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1861"}, {"timestamp": "2022-04-05T13:42:03Z", "date_only": false, "value": "2022-04-05T13:42:03.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/nNB8suzppNVgURXIHRoohy6GAgvNXUiO5vPYOSwWYBnSlSI", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "b98856fa-693a-415c-a2de-01e64d54e099"}, {"timestamp": "2022-04-05T17:01:37Z", "date_only": false, "value": "2022-04-05T17:01:37.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/poxek/1237", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "051c8586-71bb-452d-805f-d8686e3313ff", "content": "SpringShell RCE vulnerability: Guidance for protecting against and detecting CVE-2022-22965\n\u25b6\ufe0f \u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1", "url": "https://t.me/poxek/1237"}, {"timestamp": "2022-04-05T17:43:30Z", "date_only": false, "value": "2022-04-05T17:43:30+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2022-04-05T20:04:35Z", "date_only": false, "value": "2022-04-05T20:04:35.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/2810", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "e07ccf4b-d4d9-4beb-947e-3040c3a0307c", "content": "VMware \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 RCE \u0432 \u0441\u0440\u0435\u0434\u0435 Java Spring Core, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a CVE-2022-22965 \u0438\u043b\u0438 \u0436\u0435 Spring4Shell.\n\n\u0411\u0430\u0433\u0430 \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 9,8 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u0439 \u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u043f\u043b\u043e\u0442\u044c \u0434\u043e \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439. \n\n\u041f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0433\u043e PoC \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u043f\u0430\u0441\u043d\u0430, \u044d\u0442\u043e\u043c\u0443 \u0442\u0430\u043a\u0436\u0435 \u0441\u043f\u043e\u0441\u043e\u0431\u0441\u0442\u0432\u0443\u0435\u0442 \u0438 \u0448\u0438\u0440\u043e\u043a\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 Spring Framework. \u041f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043a VMware \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f Spring MVC \u0438 Spring WebFlux, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043d\u0430 JDK 9+.\u00a0\u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0442\u0440\u0435\u0431\u0443\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u043e\u0441\u044c \u043d\u0430 Tomcat \u043a\u0430\u043a \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 WAR, \u0445\u043e\u0442\u044f \u0442\u043e\u0447\u043d\u044b\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0432\u0441\u0435 \u0435\u0449\u0435 \u0438\u0437\u0443\u0447\u0430\u044e\u0442\u0441\u044f.\n\n\u041a \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 VMware \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u043e\u0438\u0441\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043a\u043e\u0434\u0430. \u0421\u043f\u0438\u0441\u043e\u043a \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 VMware, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 Spring4Shell, \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0432 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u043c \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u043c\u0435\u0440\u0435 \u0440\u0435\u0432\u0438\u0437\u0438\u0438 \u043a\u043e\u0434\u0430. \n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0447\u0442\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043a Spring4Shell: \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 VMware Tanzu \u0434\u043b\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u2014 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 2.10 \u043f\u043e 2.13; VMware Tanzu Operations Manager \u2014 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 2.8 \u043f\u043e 2.9; VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) \u2014 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 1.11 \u043f\u043e 1.13.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0443\u0441\u043f\u0435\u043b\u0438 \u0437\u0430\u043b\u0430\u0442\u0430\u0442\u044c \u0434\u044b\u0440\u044b \u043b\u0438\u0448\u044c \u0432 \u043f\u0435\u0440\u0432\u044b\u0445 \u0434\u0432\u0443\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u044f\u0445, \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0432\u0435\u0442\u043e\u043a \u0432\u0435\u0440\u0441\u0438\u0439 \u0441 \u0442\u043e\u0447\u0435\u0447\u043d\u044b\u043c\u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043c\u0438, \u043d\u043e \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f VMware Tanzu Kubernetes Grid Integrated Edition \u0432\u0441\u0435 \u0435\u0449\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435.\n\n\u041f\u0440\u0438\u043d\u0438\u043c\u0430\u044f \u0432\u043e \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435, \u0447\u0442\u043e Spring4Shell \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435, \u0430 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 VMware \u0432\u0441\u0435 \u0436\u0435 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u043e\u0442\u0435\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u043d\u043e \u043f\u0440\u0438\u0441\u043b\u0443\u0448\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0434\u0430\u043d\u043d\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u043a \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u0445\u043e\u0434\u043d\u044b\u0435 \u043f\u0443\u0442\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043f\u043e \u0442\u0435\u043c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e.", "url": "https://t.me/true_secator/2810"}, {"timestamp": "2022-04-05T21:03:41Z", "date_only": false, "value": "2022-04-05T21:03:41.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1870", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "c9edf096-71f5-42b5-b030-0831cfa1e92a", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aHacked up Dirty Pipe (CVE-2022-0847) PoC that hijacks a SUID binary to spawn a root shell. (and attempts to restore the damaged binary as well)\nURL\uff1ahttps://github.com/LudovicPatho/CVE-2022-22965_Spring4Shell\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1870"}, {"timestamp": "2022-04-05T22:00:00Z", "date_only": false, "value": "2022-04-05T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2022-04-06T04:23:33Z", "date_only": false, "value": "2022-04-06T04:23:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1873", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "ee27358a-ea4a-4f52-b7f5-a29c018ffa42", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aThe demo code showing the recent Spring4Shell RCE (CVE-2022-22965)\nURL\uff1ahttps://github.com/datawiza-inc/spring-rec-demo\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1873"}, {"timestamp": "2022-04-06T04:53:44Z", "date_only": false, "value": "2022-04-06T04:53:44.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/kmsYLGx21ItfIzCYH15walH70qRmNeNTmDtiFbw7JkzsEYY", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "417174f0-d51e-4dc9-beb8-13cd45e3d6ac"}, {"timestamp": "2022-04-06T08:03:31Z", "date_only": false, "value": "2022-04-06T08:03:31.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1874", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "7231b46d-2b8a-480c-9f6d-fca58044b8f3", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aspring\u6846\u67b6RCE\u6f0f\u6d1e CVE-2022-22965\nURL\uff1ahttps://github.com/k3rwin/spring-core-rce\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1874"}, {"timestamp": "2022-04-06T16:07:29Z", "date_only": false, "value": "2022-04-06T16:07:29.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/information_security_channel/47088", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "4d92d418-d35d-40e4-9e7d-940b4f603f7a", "content": "Spring4Shell: Zero-Day vulnerability CVE-2022-22965 in Spring Framework\nhttps://blogs.quickheal.com/spring4shell-zero-day-vulnerability-cve-2022-22965-in-spring-framework/", "url": "https://t.me/information_security_channel/47088"}, {"timestamp": "2022-04-06T16:07:30Z", "date_only": false, "value": "2022-04-06T16:07:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/information_security_channel/47089", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "a7bdf09b-8b89-4d4a-b568-3257a7f393ce", "content": "A Zero-day Remote Code Execution Vulnerability with critical severity has been identified as CVE-2022-22965 aka Spring4Shell or SpringShell...\nThe post Spring4Shell: Zero-Day vulnerability CVE-2022-22965 in Spring Framework (https://blogs.quickheal.com/spring4shell-zero-day-vulnerability-cve-2022-22965-in-spring-framework/) appeared first on Quick Heal Blog | Latest computer security news, tips, and advice (https://blogs.quickheal.com/).", "url": "https://t.me/information_security_channel/47089"}, {"timestamp": "2022-04-06T17:39:06Z", "date_only": false, "value": "2022-04-06T17:39:06+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2022-04-06T20:32:36Z", "date_only": false, "value": "2022-04-06T20:32:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/2816", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "1126cbac-41f4-4e9b-8ecd-7218575e7412", "content": "\u0415\u0441\u043b\u0438 \u043c\u044b \u043e\u0431\u044b\u0447\u043d\u043e \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0437\u043e\u043b\u043e\u0442\u044b\u0445 72 \u0447\u0430\u0441\u043e\u0432, \u0442\u043e \u0441\u043b\u0443\u0447\u0430\u0435 \u0441\u043e Spring4Shell \u043e\u0431 \u044d\u0442\u043e\u043c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e \u0441\u0442\u043e\u0438\u0442 \u0437\u0430\u0431\u044b\u0442\u044c.\n\u00a0\n\u041f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0431\u044b\u043b\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u044f\u0442\u044b \u0432 \u043f\u0435\u0440\u0432\u044b\u0435 \u0436\u0435 \u0434\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u0441\u043b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 RCE, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043a\u0430\u043a CVE-2022-22965. \u0415\u0449\u0435 \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a\u00a0\u0431\u044b\u043b\u0438 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\u00a0\n\u0415\u0449\u0435 \u043e\u0434\u043d\u0438\u043c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u043c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f CVE-2022-22963, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432\u043b\u0438\u044f\u0435\u0442 \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044e Spring Cloud, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434.\u00a0\u0422\u0440\u0435\u0442\u044c\u0435\u0439 \u0434\u044b\u0440\u043e\u0439 \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f CVE-2022-22950, DoS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0440\u0435\u0434\u043d\u0435\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\u00a0\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0438 Check Point, \u0442\u043e\u043b\u044c\u043a\u043e \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u0435 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435 \u0431\u044b\u043b\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e 37 000 \u0430\u0442\u0430\u043a Spring4Shell. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u043e\u0447\u0442\u0438 \u043a\u0430\u0436\u0434\u0430\u044f \u0448\u0435\u0441\u0442\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f \u0432\u043e \u0432\u0441\u0435\u043c \u043c\u0438\u0440\u0435, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f Spring4Shell, \u0443\u0436\u0435 \u0441\u0442\u0430\u043b\u0430 \u043c\u0438\u0448\u0435\u043d\u044c\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041d\u0430 \u043f\u0435\u0440\u0432\u043e\u043c \u043c\u0435\u0441\u0442\u0435 \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0436\u0435\u0440\u0442\u0432 - \u0415\u0432\u0440\u043e\u043f\u0430, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f 20%. \n\u00a0\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0438\u043c\u0438 \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u043d\u0430 \u0434\u043e\u043b\u044e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f 28% \u043e\u0442 \u043e\u0431\u0449\u0435\u0433\u043e \u0447\u0438\u0441\u043b\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0437-\u0437\u0430 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u043e\u043d\u0438 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043e\u0442\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u0446\u0435\u043b\u044f\u043c\u0438 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u043f\u043e\u0441\u0442\u0430\u0432\u043e\u043a.\n\u00a0\n\u041f\u043e\u043a\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u043e \u0437\u0430\u043d\u044f\u0442\u044b \u043e\u0446\u0435\u043d\u043a\u043e\u0439 \u0432\u043b\u0438\u044f\u043d\u0438\u044f Spring4Shell \u043d\u0430 \u0441\u0432\u043e\u0438 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u044e\u0442 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u043c\u0438 RCE \u0432 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043f\u043e\u043b\u043d\u044b\u043c \u0445\u043e\u0434\u043e\u043c. \u041a \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c\u0443 \u043c\u043e\u043c\u0435\u043d\u0442\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043a\u0430\u043a \u0434\u043b\u044f Spring4Shell, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f CVE-2022-22963.\n\u00a0\n\u041f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u00a0\u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u00a0\u0432\u0435\u0440\u0441\u0438\u0438 Spring Framework 5.3.18 \u0438 5.2.20, \u0430 \u0442\u0430\u043a\u0436\u0435 Spring Boot 2.5.12, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0440\u0435\u0448\u0430\u044e\u0442 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 RCE, \u0430\u00a0\u0442\u0430\u043a\u0436\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0441\u043c\u044f\u0433\u0447\u0435\u043d\u0438\u044e.\u00a0\u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e \u044d\u0442\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439, \u043d\u0435 \u0437\u0430\u0431\u044b\u0432\u0430\u044f \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e CVE-2022-22963 \u0438 CVE-2022-22947 \u0432 Spring Cloud Function \u0438 Spring Cloud Gateway.", "url": "https://t.me/true_secator/2816"}, {"timestamp": "2022-04-06T22:00:00Z", "date_only": false, "value": "2022-04-06T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2022-04-06T22:36:57Z", "date_only": false, "value": "2022-04-06T22:36:57.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cKure/9291", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "2d209d08-3742-4686-819f-5d4ebb78cd13", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Update! Spring4Shell Zero-Day Vulnerability CVE-2022-22965: All You Need To Know.\n\nhttps://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html\n\nhttps://jfrog.com/blog/springshell-zero-day-vulnerability-all-you-need-to-know/", "url": "https://t.me/cKure/9291"}, {"timestamp": "2022-04-07T01:44:01Z", "date_only": false, "value": "2022-04-07T01:44:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1882", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "97dde259-dee8-4167-9cc5-a3b2bcbb7756", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aSpring Framework RCE (CVE-2022-22965) Nmap (NSE) Checker (Non-Intrusive)\nURL\uff1ahttps://github.com/alt3kx/CVE-2022-22965\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1882"}, {"timestamp": "2022-04-07T02:41:25Z", "date_only": false, "value": "2022-04-07T02:41:25.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1883", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "85b681ea-0a17-49d4-b28d-0ae17dccfc6f", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-22965 pocsuite3 POC\nURL\uff1ahttps://github.com/wikiZ/springboot_CVE-2022-22965\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1883"}, {"timestamp": "2022-04-07T03:55:38Z", "date_only": false, "value": "2022-04-07T03:55:38.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1886", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "46ee1115-6feb-4da9-a4e3-2226b28003cb", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-22965\u5199\u5165\u51b0\u874ewebshell\u811a\u672c\nURL\uff1ahttps://github.com/4nth0ny1130/spring4shell_behinder\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1886"}, {"timestamp": "2022-04-07T05:01:17Z", "date_only": false, "value": "2022-04-07T05:01:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/qxbEBfVMGrP2q6iErZM22aABSaMWHKEFbtXSfHnHNnS0JZo", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "4de15735-3545-43f0-bc2d-19ed91e6934b"}, {"timestamp": "2022-04-07T08:02:41Z", "date_only": false, "value": "2022-04-07T08:02:41.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1888", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "a611b443-3828-40ad-86c6-065caa6ea0fd", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aspringFramework_CVE-2022-22965_RCE\u7b80\u5355\u5229\u7528\nURL\uff1ahttps://github.com/liangyueliangyue/spring-core-rce\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1888"}, {"timestamp": "2022-04-07T09:19:17Z", "date_only": false, "value": "2022-04-07T09:19:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1892", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "322ac547-3edc-4013-b5f4-e0e6d26f5717", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aSpring4Shell PoC (CVE-2022-22965)\nURL\uff1ahttps://github.com/t3amj3ff/Spring4ShellPoC\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1892"}, {"timestamp": "2022-04-07T10:37:18Z", "date_only": false, "value": "2022-04-07T10:37:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/BlueRedTeam/1904", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "325402ed-644a-4569-a14c-7ec60cbc5c53", "content": "#CVE-2022\n\nSpring Framework RCE (CVE-2022-22965) Nmap (NSE) Checker (Non-Intrusive)\n\nhttps://github.com/alt3kx/CVE-2022-22965\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1904"}, {"timestamp": "2022-04-07T15:53:31Z", "date_only": false, "value": "2022-04-07T15:53:31.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1899", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "4c868770-65be-489a-879f-e0a1d961dadb", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aVulnerabilidad RCE en Spring Framework v\u00eda Data Binding on JDK 9+ (CVE-2022-22965 aka \\\"Spring4Shell\\\")\nURL\uff1ahttps://github.com/GuayoyoCyber/CVE-2022-22965\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1899"}, {"timestamp": "2022-04-07T18:00:44Z", "date_only": false, "value": "2022-04-07T18:00:44+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2022-04-07T18:37:27Z", "date_only": false, "value": "2022-04-07T18:37:27.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/NeKaspersky/2088", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "c558e686-7939-4b09-b644-fb7f37780395", "content": "\u041a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0430 \u043d\u0430 Java-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Spring \u0438\u043b\u0438 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Spring4Shell\n\n\u041d\u043e\u0432\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Spring4Shell (CVE-2022-22965) \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435. \u0415\u0451 \u0441\u0440\u0430\u0437\u0443 \u043e\u0442\u043d\u0435\u0441\u043b\u0438 \u043a \u043a\u043b\u0430\u0441\u0441\u0443 RCE (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u0435\u043c\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435, \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u0442.\u043f.) \u0438 \u043e\u0446\u0435\u043d\u0438\u043b\u0438 \u0432 9.8 \u0431\u0430\u043b\u043b\u043e\u0432 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS v3.0. \u0412 \u043d\u043e\u0447\u044c \u0441\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a\u0430 \u043d\u0430 \u0441\u0440\u0435\u0434\u0443 \u0431\u044b\u043b\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0423\u0436\u0435 \u0432 \u0441\u0440\u0435\u0434\u0443 \u043d\u0430 GitHub \u043d\u0435\u043d\u0430\u0434\u043e\u043b\u0433\u043e \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442. \u0415\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u043a\u043e\u0434 \u0443\u0441\u043f\u0435\u043b\u0438 \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043d\u043e \u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438.\n\n\u0421\u0430\u043c\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Spring4Shell \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u043d\u043d\u044b\u0445 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Spring Core \u0432 Java Development Kit (JDK) \u0432\u0435\u0440\u0441\u0438\u0438 9 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0445. \u0422\u0430\u043a\u0436\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043a\u0430\u043a CVE-2010-1622. \u041f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u043d\u0435 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u043c\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u041f\u043e\u043c\u0438\u043c\u043e \u0434\u0440\u0443\u0433\u0438\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-22963. \u041e\u043d\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441\u043e Spring Cloud Function 3.1.6, 3.2.2 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0441\u0442\u0430\u0440\u044b\u043c\u0438, \u043d\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438. \u041f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 SpEL \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438. \u041e\u043d \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0443 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c.\n\n\u041b\u0438\u0448\u044c \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u0435 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435 \u0431\u044b\u043b\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 37000 \u0430\u0442\u0430\u043a \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 Spring4Shell. \u0422\u0430\u043a\u0436\u0435 16% \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0432\u043e \u0432\u0441\u0435\u043c \u043c\u0438\u0440\u0435 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u043b\u0438 \u043e\u0442 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. \u041f\u043e\u043d\u0435\u0441\u043b\u0438 \u0443\u0449\u0435\u0440\u0431 28% \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435. \n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 RCE \u0440\u0435\u0448\u0438\u043b\u0438\u0441\u044c \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 Spring Framework 5.3.18 \u0438 5.2.20, \u0438 Spring Boot 2.5.12 \u0438 2.6.6. \u041e\u0434\u043d\u0430\u043a\u043e \u0431\u044b\u0432\u0430\u044e\u0442 \u0441\u043b\u0443\u0447\u0430\u0438, \u043a\u043e\u0433\u0434\u0430 \u043d\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 Spring \u043d\u0430 \u0441\u0432\u043e\u0451\u043c \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u0430\u0439\u0442\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b.\n@NeKaspersky", "url": "https://t.me/NeKaspersky/2088"}, {"timestamp": "2022-04-08T11:06:51Z", "date_only": false, "value": "2022-04-08T11:06:51.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/49944", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "cb1ba174-1af8-4ab2-b0f3-80d295fb4f0d", "content": "CVE-2022-22965: Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware\n\nhttps://ift.tt/gLyOosX", "url": "https://t.me/ctinow/49944"}, {"timestamp": "2022-04-08T15:05:17Z", "date_only": false, "value": "2022-04-08T15:05:17.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/47112", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "13f40b7a-b2a1-4bcf-b42d-95d0ef421ca0", "content": "Spring4Shell Vulnerability Exploited by Mirai Botnet\nhttps://www.securityweek.com/spring4shell-vulnerability-exploited-mirai-botnet\n\nCybersecurity firm Trend Micro on Friday confirmed some earlier reports that the new Spring4Shell vulnerability has been exploited by the Mirai botnet.\nTwo critical vulnerabilities have been patched recently in the popular Java application development framework Spring: CVE-2022-22965 (aka Spring4Shell and SpringShell) and CVE-2022-22963.\nread more (https://www.securityweek.com/spring4shell-vulnerability-exploited-mirai-botnet)", "url": "https://t.me/information_security_channel/47112"}, {"timestamp": "2022-04-10T13:43:13Z", "date_only": false, "value": "2022-04-10T13:43:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/5781", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "964b0045-8e44-4480-b92a-2b465ab28c7a", "content": "#Blue_Team_Techniques\n1. A list of open source web security scanners\nhttps://github.com/psiinon/open-source-web-scanners\n2. Script to check for Spring4Shell vulnerability\nhttps://github.com/jrgdiaz/Spring4Shell-CVE-2022-22965.py\n3. A fully automated, reliable, and accurate scanner for finding Spring4Shell/Spring Cloud RCE vulnerabilities\nhttps://github.com/fullhunt/spring4shell-scan", "url": "https://t.me/CyberSecurityTechnologies/5781"}, {"timestamp": "2022-04-10T22:00:00Z", "date_only": false, "value": "2022-04-10T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.6.date"}, {"timestamp": "2022-04-11T00:00:00Z", "date_only": false, "value": "2022-04-11T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-326", "record": "CERTFR-2022-AVI-326", "field": "revisions.0.revision_date"}, {"timestamp": "2022-04-11T08:02:01Z", "date_only": false, "value": "2022-04-11T08:02:01.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/BlueRedTeam/1920", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "b13899d1-2d41-4ea1-ac27-d913ad6be750", "content": "#Blue_Team\n\n1. Firewall analysis: A portable graph based approach\nhttps://diablohorn.com/2022/04/09/firewall-analysis-a-portable-graph-based-approach\n2. Analyzing the Exploitation of Spring4Shell Vulnerability (CVE-2022-22965) in Weaponizing and Executing the Mirai Botnet Malware\nhttps://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html\n\n@BlueRedTeam", "url": "https://t.me/BlueRedTeam/1920"}, {"timestamp": "2022-04-11T11:00:18Z", "date_only": false, "value": "2022-04-11T11:00:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/poxek/1280", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "5aaf9059-428d-40ab-be00-d4d29ab0821b", "content": "Safer PoC CVE-2022-22965\nA Safer PoC for CVE-2022-22965 (Spring4Shell)\n\u0424\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c:\n- \u0421\u043e\u0437\u0434\u0430\u0435\u0442 \u0444\u0430\u0439\u043b \u0441 \u0438\u043c\u0435\u043d\u0435\u043c CVE_2022-22965_exploited.txt \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 tomcat \u00abwebapps/ROOT\u00bb.\n- \u041e\u043f\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0439 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432\u044b\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\n- \u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u0443\u0442\u0435\u043c \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0432\u044b\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 .txt, \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0432\u0430\u0448\u0435\u0433\u043e tomcat \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0442\u0440\u0435\u0431\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0440\u0443\u0447\u043d\u0443\u044e.\n- \u0414\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u043e\u0433\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430; \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u044e\u0442 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 \u043e\u0448\u0438\u0431\u043a\u0438 \u0441 HTTP-\u0441\u0442\u0430\u0442\u0443\u0441\u043e\u043c 200\nhttps://github.com/colincowie/Safer_PoC_CVE-2022-22965\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1", "url": "https://t.me/poxek/1280"}, {"timestamp": "2022-04-11T12:14:59Z", "date_only": false, "value": "2022-04-11T12:14:59.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/1915", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "2c5313d4-cbd6-41e0-bd23-dc2780d1b9da", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aSpring4Shell , Spring Framework RCE (CVE-2022-22965)\nURL\uff1ahttps://github.com/Loneyers/Spring4Shell\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/1915"}, {"timestamp": "2022-04-11T12:44:55Z", "date_only": false, "value": "2022-04-11T12:44:55.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/5785", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "e7e409a8-cc4f-4615-82eb-7ccd850ff67e", "content": "#Blue_Team_Techniques\n1. Firewall analysis: A portable graph based approach\nhttps://diablohorn.com/2022/04/09/firewall-analysis-a-portable-graph-based-approach\n2. Analyzing the Exploitation of Spring4Shell Vulnerability (CVE-2022-22965) in Weaponizing and Executing the Mirai Botnet Malware\nhttps://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html", "url": "https://t.me/CyberSecurityTechnologies/5785"}, {"timestamp": "2022-04-11T13:47:47Z", "date_only": false, "value": "2022-04-11T13:47:47.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/2830", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "05199918-73b5-4d37-8f5b-b2f4f3fae6a7", "content": "Trend Micro \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 Spring4Shell \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u043c Mirai. \u041f\u0435\u0440\u0432\u044b\u043c\u0438 \u0430\u0442\u0430\u043a\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0435 \u043a\u043e\u043b\u043b\u0435\u0433\u0438 \u0438\u0437 Qihoo 360.\n\n\u0412 \u044d\u0442\u043e\u043c \u043f\u043b\u0430\u043d\u0435 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0442 \u0432\u0435\u0441\u044c\u043c\u0430 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044f \u0441\u0432\u0435\u0436\u0438\u0435 CVE \u0432 \u0441\u0432\u043e\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432, \u043a\u0430\u043a \u044d\u0442\u043e \u0431\u044b\u043b\u043e \u0440\u0430\u043d\u0435\u0435 \u0441 Log4Shell.\n\n\u0420\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e \u0434\u0432\u0443\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 CVE-2022-22965 \u0438 CVE-2022-22963 \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Spring, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430. \n\n\u041a\u0430\u0441\u0430\u0435\u043c\u043e Mirai \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 Spring4Shell, \u043a\u043e\u0433\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e Mirai \u0432 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432 \u0440\u0435\u0433\u0438\u043e\u043d\u0435 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0430. \u041e\u0431\u0440\u0430\u0437\u0435\u0446 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u0441\u044f \u0432 \u043f\u0430\u043f\u043a\u0443 \u00ab/tmp\u00bb \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0441\u044f \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u0441\u043b\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0433\u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u00abchmod\u00bb.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u043e \u0442\u043e, \u0447\u0442\u043e Spring4Shell \u043d\u0435 \u0442\u0430\u043a \u0448\u0438\u0440\u043e\u043a\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430, \u043a\u0430\u043a Log4Shell, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u0441\u0435 \u0436\u0435 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442 \u043c\u043d\u043e\u0433\u0438\u0445, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u044c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0438\u0441\u0442\u0435\u043c, \u043f\u043e\u043a\u0430 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0438 \u041f\u041e \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u044e\u0442 \u0441\u0442\u0435\u043f\u0435\u043d\u044c \u0432\u043b\u0438\u044f\u043d\u0438\u044f Spring4Shell\u00a0\u043d\u0430 \u0441\u0432\u043e\u0438 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b \u0438 \u0433\u043e\u0442\u043e\u0432\u044f\u0442 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0430\u0442\u0447\u0438.", "url": "https://t.me/true_secator/2830"}, {"timestamp": "2022-04-11T14:07:30Z", "date_only": false, "value": "2022-04-11T14:07:30+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022:1306", "record": "RHSA-2022:1306", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-11T14:07:30Z", "date_only": false, "value": "2022-04-11T14:07:30+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022_1306", "record": "RHSA-2022_1306", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-11T14:07:30Z", "date_only": false, "value": "2022-04-11T14:07:30+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022:1306", "record": "RHSA-2022:1306", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-04-11T14:07:30Z", "date_only": false, "value": "2022-04-11T14:07:30+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022_1306", "record": "RHSA-2022_1306", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-04-11T14:07:30Z", "date_only": false, "value": "2022-04-11T14:07:30+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2022:1306", "record": "RHSA-2022:1306", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-11T14:07:30Z", "date_only": false, "value": "2022-04-11T14:07:30+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2022_1306", "record": "RHSA-2022_1306", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-11T16:45:24Z", "date_only": false, "value": "2022-04-11T16:45:24.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/MrVGunz/108", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "d43cc124-a30d-4b8e-9a8a-8bed1d04047e", "content": "CVE-2022-22965 : Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware\nhttps://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html", "url": "https://t.me/MrVGunz/108"}, {"timestamp": "2022-04-11T17:36:49Z", "date_only": false, "value": "2022-04-11T17:36:49", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_release_date.data.3.date"}, {"timestamp": "2022-04-11T17:54:26Z", "date_only": false, "value": "2022-04-11T17:54:26+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2022-04-11T22:00:00Z", "date_only": false, "value": "2022-04-11T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.7.date"}, {"timestamp": "2022-04-12T00:00:00Z", "date_only": false, "value": "2022-04-12T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-326", "record": "CERTFR-2022-AVI-326", "field": "revisions.1.revision_date"}, {"timestamp": "2022-04-12T18:27:07Z", "date_only": false, "value": "2022-04-12T18:27:07+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.revision_history.6.date"}, {"timestamp": "2022-04-12T18:32:07Z", "date_only": false, "value": "2022-04-12T18:32:07+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022:1333", "record": "RHSA-2022:1333", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-12T18:32:07Z", "date_only": false, "value": "2022-04-12T18:32:07+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022_1333", "record": "RHSA-2022_1333", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-12T18:32:07Z", "date_only": false, "value": "2022-04-12T18:32:07+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022:1333", "record": "RHSA-2022:1333", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-04-12T18:32:07Z", "date_only": false, "value": "2022-04-12T18:32:07+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022_1333", "record": "RHSA-2022_1333", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-04-12T18:32:07Z", "date_only": false, "value": "2022-04-12T18:32:07+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2022:1333", "record": "RHSA-2022:1333", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-12T18:32:07Z", "date_only": false, "value": "2022-04-12T18:32:07+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2022_1333", "record": "RHSA-2022_1333", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-12T22:00:00Z", "date_only": false, "value": "2022-04-12T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.8.date"}, {"timestamp": "2022-04-13T07:01:06Z", "date_only": false, "value": "2022-04-13T07:01:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/poxek/1301", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "f62fa4c3-e440-40be-b49c-2980c6ac3a64", "content": "CVE-2022-22965 - vulnerable app and PoC\nhttps://github.com/DDuarte/springshell-rce-poc\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1\ufe0f", "url": "https://t.me/poxek/1301"}, {"timestamp": "2022-04-13T14:45:53Z", "date_only": false, "value": "2022-04-13T14:45:53+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022:1360", "record": "RHSA-2022:1360", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-13T14:45:53Z", "date_only": false, "value": "2022-04-13T14:45:53+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022_1360", "record": "RHSA-2022_1360", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-13T14:45:53Z", "date_only": false, "value": "2022-04-13T14:45:53+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022:1360", "record": "RHSA-2022:1360", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-04-13T14:45:53Z", "date_only": false, "value": "2022-04-13T14:45:53+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022_1360", "record": "RHSA-2022_1360", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-04-13T14:45:53Z", "date_only": false, "value": "2022-04-13T14:45:53+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2022:1360", "record": "RHSA-2022:1360", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-13T14:45:53Z", "date_only": false, "value": "2022-04-13T14:45:53+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2022_1360", "record": "RHSA-2022_1360", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-13T15:01:19Z", "date_only": false, "value": "2022-04-13T15:01:19", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_release_date.data.4.date"}, {"timestamp": "2022-04-13T16:54:53Z", "date_only": false, "value": "2022-04-13T16:54:53+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.revision_history.7.date"}, {"timestamp": "2022-04-13T22:00:00Z", "date_only": false, "value": "2022-04-13T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.9.date"}, {"timestamp": "2022-04-13T22:20:55Z", "date_only": false, "value": "2022-04-13T22:20:55", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_release_date.data.5.date"}, {"timestamp": "2022-04-14T00:00:00Z", "date_only": false, "value": "2022-04-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-345", "record": "CERTFR-2022-AVI-345", "field": "revisions.0.revision_date"}, {"timestamp": "2022-04-14T09:02:29Z", "date_only": false, "value": "2022-04-14T09:02:29.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/poxek/1313", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "05f3b9fa-fd25-4a97-bda8-81a8178bd017", "content": "CVE-2022-22965 - vulnerable app and PoC\nhttps://github.com/DDuarte/springshell-rce-poc\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1", "url": "https://t.me/poxek/1313"}, {"timestamp": "2022-04-14T17:09:11Z", "date_only": false, "value": "2022-04-14T17:09:11+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022:1378", "record": "RHSA-2022:1378", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-14T17:09:11Z", "date_only": false, "value": "2022-04-14T17:09:11+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022_1378", "record": "RHSA-2022_1378", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-14T17:09:11Z", "date_only": false, "value": "2022-04-14T17:09:11+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022:1378", "record": "RHSA-2022:1378", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-04-14T17:09:11Z", "date_only": false, "value": "2022-04-14T17:09:11+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022_1378", "record": "RHSA-2022_1378", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-04-14T17:09:11Z", "date_only": false, "value": "2022-04-14T17:09:11+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2022:1378", "record": "RHSA-2022:1378", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-14T17:09:11Z", "date_only": false, "value": "2022-04-14T17:09:11+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2022_1378", "record": "RHSA-2022_1378", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-14T17:27:42Z", "date_only": false, "value": "2022-04-14T17:27:42+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.revision_history.8.date"}, {"timestamp": "2022-04-14T17:33:07Z", "date_only": false, "value": "2022-04-14T17:33:07+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022:1379", "record": "RHSA-2022:1379", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-14T17:33:07Z", "date_only": false, "value": "2022-04-14T17:33:07+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022_1379", "record": "RHSA-2022_1379", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-14T17:33:07Z", "date_only": false, "value": "2022-04-14T17:33:07+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022:1379", "record": "RHSA-2022:1379", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-04-14T17:33:07Z", "date_only": false, "value": "2022-04-14T17:33:07+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022_1379", "record": "RHSA-2022_1379", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-04-14T17:33:07Z", "date_only": false, "value": "2022-04-14T17:33:07+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2022:1379", "record": "RHSA-2022:1379", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-14T17:33:07Z", "date_only": false, "value": "2022-04-14T17:33:07+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2022_1379", "record": "RHSA-2022_1379", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-15T15:24:03Z", "date_only": false, "value": "2022-04-15T15:24:03", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_release_date.data.6.date"}, {"timestamp": "2022-04-15T15:24:12Z", "date_only": false, "value": "2022-04-15T15:24:12", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_release_date.data.7.date"}, {"timestamp": "2022-04-18T22:00:00Z", "date_only": false, "value": "2022-04-18T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.10.date"}, {"timestamp": "2022-04-19T00:00:00Z", "date_only": false, "value": "2022-04-19T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-254054", "record": "SSA-254054", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-19T00:00:00Z", "date_only": false, "value": "2022-04-19T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_siemens \u00b7 SSA-254054", "record": "SSA-254054", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-19T17:41:11Z", "date_only": false, "value": "2022-04-19T17:41:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/OxC8HR/131", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "ff1e74b4-fd57-4ca7-ad7a-25d81a44de53", "content": "Acunetix v14.7 Build 220401065 - 1st April 2022\n\nCrack - https://t.me/zer0daylab/2381\n\nNew Vulnerability checks\n\n\u2022 Test for Spring4Shell vulnerability (CVE-2022-22965)", "url": "https://t.me/OxC8HR/131"}, {"timestamp": "2022-04-19T17:41:12Z", "date_only": false, "value": "2022-04-19T17:41:12.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/OxC8HR/139", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "239e239e-209a-468f-b568-c98423157caa", "content": "Invicti Standard 6.4.3.35616 - 4th April 2022\n\nNEW SECURITY CHECKS\n\nAdded Remote Code Execution (CVE-2022-22965) a.k.a. Spring4Shell detection support.", "url": "https://t.me/OxC8HR/139"}, {"timestamp": "2022-04-19T22:00:00Z", "date_only": false, "value": "2022-04-19T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-19T22:00:00Z", "date_only": false, "value": "2022-04-19T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-19T22:00:00Z", "date_only": false, "value": "2022-04-19T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-04-20T00:00:00Z", "date_only": false, "value": "2022-04-20T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-360", "record": "CERTFR-2022-AVI-360", "field": "revisions.0.revision_date"}, {"timestamp": "2022-04-20T04:00:00Z", "date_only": false, "value": "2022-04-20T04:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=791", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "6827cfbe-acdb-4b76-bc78-67c28b908828", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=791"}, {"timestamp": "2022-04-20T13:46:52Z", "date_only": false, "value": "2022-04-20T13:46:52.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/50527", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "96b667b4-b6a5-48ce-b6fb-91eecad4e918", "content": "Spring4Shell Vulnerability CVE-2022-22965 Exploited to Deploy Cryptocurrency Miners\n\nhttps://ift.tt/7KY2l01", "url": "https://t.me/ctinow/50527"}, {"timestamp": "2022-04-20T17:06:47Z", "date_only": false, "value": "2022-04-20T17:06:47.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/50545", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "457683b4-b304-4809-85c6-ef9e79da2018", "content": "Analyzing Attempts to Exploit the Spring4Shell Vulnerability CVE-2022-22965 to Deploy Cryptocurrency Miners\n\nhttps://ift.tt/7KY2l01", "url": "https://t.me/ctinow/50545"}, {"timestamp": "2022-04-21T00:00:00Z", "date_only": false, "value": "2022-04-21T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-371", "record": "CERTFR-2022-AVI-371", "field": "revisions.0.revision_date"}, {"timestamp": "2022-04-21T00:00:00Z", "date_only": false, "value": "2022-04-21T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-376", "record": "CERTFR-2022-AVI-376", "field": "revisions.0.revision_date"}, {"timestamp": "2022-04-21T21:01:20Z", "date_only": false, "value": "2022-04-21T21:01:20+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.revision_history.9.date"}, {"timestamp": "2022-04-25T00:00:00Z", "date_only": true, "value": "2022-04-25", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2022-22965", "field": "evidence.0.details.due_date", "uuid": "c7e9e0be-415b-432d-87ef-47f41a518a9d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-04-25T00:00:00Z", "date_only": true, "value": "2022-04-25", "kind": "other", "label": "Remediation due", "source": "gsd \u00b7 GSD-2022-22965", "record": "GSD-2022-22965", "field": "namespaces.cisa.gov.dueDate"}, {"timestamp": "2022-04-26T17:43:02Z", "date_only": false, "value": "2022-04-26T17:43:02+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.revision_history.10.date"}, {"timestamp": "2022-04-26T22:00:00Z", "date_only": false, "value": "2022-04-26T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.11.date"}, {"timestamp": "2022-04-27T00:00:00Z", "date_only": false, "value": "2022-04-27T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-254054", "record": "SSA-254054", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2022-04-27T09:46:46Z", "date_only": false, "value": "2022-04-27T09:46:46+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022:1626", "record": "RHSA-2022:1626", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-27T09:46:46Z", "date_only": false, "value": "2022-04-27T09:46:46+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022_1626", "record": "RHSA-2022_1626", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-27T09:46:46Z", "date_only": false, "value": "2022-04-27T09:46:46+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022:1626", "record": "RHSA-2022:1626", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-04-27T09:46:46Z", "date_only": false, "value": "2022-04-27T09:46:46+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022_1626", "record": "RHSA-2022_1626", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-04-27T09:46:46Z", "date_only": false, "value": "2022-04-27T09:46:46+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2022:1626", "record": "RHSA-2022:1626", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-27T09:46:46Z", "date_only": false, "value": "2022-04-27T09:46:46+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2022_1626", "record": "RHSA-2022_1626", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-27T09:46:55Z", "date_only": false, "value": "2022-04-27T09:46:55+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022:1627", "record": "RHSA-2022:1627", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-27T09:46:55Z", "date_only": false, "value": "2022-04-27T09:46:55+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022_1627", "record": "RHSA-2022_1627", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-04-27T09:46:55Z", "date_only": false, "value": "2022-04-27T09:46:55+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022:1627", "record": "RHSA-2022:1627", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-04-27T09:46:55Z", "date_only": false, "value": "2022-04-27T09:46:55+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2022_1627", "record": "RHSA-2022_1627", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2022-04-27T09:46:55Z", "date_only": false, "value": "2022-04-27T09:46:55+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2022:1627", "record": "RHSA-2022:1627", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-27T09:46:55Z", "date_only": false, "value": "2022-04-27T09:46:55+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2022_1627", "record": "RHSA-2022_1627", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-04-27T18:18:11Z", "date_only": false, "value": "2022-04-27T18:18:11", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_release_date.data.9.date"}, {"timestamp": "2022-04-27T18:19:24Z", "date_only": false, "value": "2022-04-27T18:19:24", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_release_date.data.8.date"}, {"timestamp": "2022-04-27T22:00:00Z", "date_only": false, "value": "2022-04-27T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.12.date"}, {"timestamp": "2022-04-29T16:53:49Z", "date_only": false, "value": "2022-04-29T16:53:49+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.revision_history.11.date"}, {"timestamp": "2022-05-01T22:00:00Z", "date_only": false, "value": "2022-05-01T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2022-05-03T22:00:00Z", "date_only": false, "value": "2022-05-03T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2022-05-04T22:00:00Z", "date_only": false, "value": "2022-05-04T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2022-05-05T22:00:00Z", "date_only": false, "value": "2022-05-05T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2022-05-10T04:15:43Z", "date_only": false, "value": "2022-05-10T04:15:43.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/2142", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "95c8a8fd-9559-41bf-9b8a-6f2916f3509d", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-22965\u5199\u5165\u51b0\u874ewebshell\u811a\u672c\nURL\uff1ahttps://github.com/MrCl0wnLab/Nuclei-Template-Exploit-CVE-2022-1388-BIG-IP-iControl-REST\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/2142"}, {"timestamp": "2022-05-10T13:51:22Z", "date_only": false, "value": "2022-05-10T13:51:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ETHICALHACKERSCOMMUNITY2/324", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "995ed714-cf8d-43ef-bd75-8c9d9241a9c3", "content": "This is a dockerized application that is vulnerable (https://www.kitploit.com/search/label/Vulnerable) to the Spring4Shell vulnerability (https://www.kitploit.com/search/label/Vulnerability) (CVE-2022-22965). Full Java source for the war is provided and modifiable, the war will get re-built whenever the docker image is built. The built WAR will then be loaded by Tomcat. There is nothing special about this application, it's a simple hello world that's based off Spring tutorials (https://spring.io/guides/gs/handling-form-submission/).  Details: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilitiesHaving issues with the POC? Check out the LunaSec fork at: https://github.com/lunasec-io/Spring4Shell-POC, it's more actively maintained.  Requirements    Docker  Python3 + requests library    Instructions    Clone the repository  Build and run the container: docker build . -t spring4shell && docker run -p 8080:8080 spring4shell  App should now be available at http://localhost:8080/helloworld/greeting", "url": "https://t.me/ETHICALHACKERSCOMMUNITY2/324"}, {"timestamp": "2022-05-10T13:51:24Z", "date_only": false, "value": "2022-05-10T13:51:24.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ETHICALHACKERSCOMMUNITY2/322", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "f258a85f-0c27-482a-afb0-ad7bd0e75301", "content": "Spring4Shell-POC - Dockerized Spring4Shell (CVE-2022-22965) PoC Application And Exploit\nhttp://www.kitploit.com/2022/05/spring4shell-poc-dockerized.html", "url": "https://t.me/ETHICALHACKERSCOMMUNITY2/322"}, {"timestamp": "2022-05-10T14:05:34Z", "date_only": false, "value": "2022-05-10T14:05:34.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spring_framework_rce_spring4shell.rb", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "459ccddc-5442-412d-8058-7a2239ce3e68", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spring_framework_rce_spring4shell.rb"}, {"timestamp": "2022-05-11T22:00:00Z", "date_only": false, "value": "2022-05-11T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.13.date"}, {"timestamp": "2022-05-12T00:00:00Z", "date_only": false, "value": "2022-05-12T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-456", "record": "CERTFR-2022-AVI-456", "field": "revisions.0.revision_date"}, {"timestamp": "2022-05-18T00:00:00Z", "date_only": false, "value": "2022-05-18T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-472", "record": "CERTFR-2022-AVI-472", "field": "revisions.0.revision_date"}, {"timestamp": "2022-05-19T00:00:00Z", "date_only": false, "value": "2022-05-19T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_update_date.data.0.date"}, {"timestamp": "2022-05-20T00:00:00Z", "date_only": false, "value": "2022-05-20T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-481", "record": "CERTFR-2022-AVI-481", "field": "revisions.0.revision_date"}, {"timestamp": "2022-05-20T00:20:11Z", "date_only": false, "value": "2022-05-20T00:20:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/2239", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "af36dd1e-95ee-4563-8ed8-4a6461e748cf", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-22965 Spring4Shell research & PoC\nURL\uff1ahttps://github.com/cxzero/CVE-2022-22965-spring4shell\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/2239"}, {"timestamp": "2022-05-23T00:00:00Z", "date_only": false, "value": "2022-05-23T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-487", "record": "CERTFR-2022-AVI-487", "field": "revisions.0.revision_date"}, {"timestamp": "2022-05-25T00:00:00Z", "date_only": false, "value": "2022-05-25T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-494", "record": "CERTFR-2022-AVI-494", "field": "revisions.0.revision_date"}, {"timestamp": "2022-05-26T22:00:00Z", "date_only": false, "value": "2022-05-26T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.14.date"}, {"timestamp": "2022-06-01T17:22:35Z", "date_only": false, "value": "2022-06-01T17:22:35+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.revision_history.12.date"}, {"timestamp": "2022-06-01T22:00:00Z", "date_only": false, "value": "2022-06-01T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.15.date"}, {"timestamp": "2022-06-06T00:00:00Z", "date_only": true, "value": "2022-06-06", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-523", "record": "CERTFR-2022-AVI-523", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2022-06-07T00:00:00Z", "date_only": false, "value": "2022-06-07T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-523", "record": "CERTFR-2022-AVI-523", "field": "revisions.0.revision_date"}, {"timestamp": "2022-06-07T22:00:00Z", "date_only": false, "value": "2022-06-07T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2022-06-13T00:00:00Z", "date_only": false, "value": "2022-06-13T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-539", "record": "CERTFR-2022-AVI-539", "field": "revisions.0.revision_date"}, {"timestamp": "2022-06-14T00:00:00Z", "date_only": false, "value": "2022-06-14T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-254054", "record": "SSA-254054", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2022-06-17T00:00:00Z", "date_only": false, "value": "2022-06-17T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-568", "record": "CERTFR-2022-AVI-568", "field": "revisions.0.revision_date"}, {"timestamp": "2022-06-20T01:10:15Z", "date_only": false, "value": "2022-06-20T01:10:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/2540", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "cfa9989b-47ae-42c1-9f4c-24156d251f59", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aburpsuite \u7684Spring\u6f0f\u6d1e\u626b\u63cf\u63d2\u4ef6\u3002SpringVulScan\uff1a\u652f\u6301\u68c0\u6d4b\uff1a\u8def\u7531\u6cc4\u9732|CVE-2022-22965|CVE-2022-22963|CVE-2022-22947|CVE-2016-4977\nURL\uff1ahttps://github.com/tpt11fb/SpringVulScan\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/2540"}, {"timestamp": "2022-06-21T00:00:00Z", "date_only": false, "value": "2022-06-21T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-572", "record": "CERTFR-2022-AVI-572", "field": "revisions.0.revision_date"}, {"timestamp": "2022-06-21T22:00:00Z", "date_only": false, "value": "2022-06-21T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.6.date"}, {"timestamp": "2022-07-01T18:37:41Z", "date_only": false, "value": "2022-07-01T18:37:41.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/2607", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "9ac4567e-11f7-4452-aa5f-709187998248", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aspring4shell | CVE-2022-22965\nURL\uff1ahttps://github.com/p1ckzi/CVE-2022-22965\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/2607"}, {"timestamp": "2022-07-05T15:04:11Z", "date_only": false, "value": "2022-07-05T15:04:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/2640", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "0b90a109-9226-4bf1-a6fc-425cead23f9a", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aEXP for Spring4Shell(CVE-2022-22965)\nURL\uff1ahttps://github.com/D1mang/Spring4Shell-CVE-2022-22965\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/2640"}, {"timestamp": "2022-07-12T00:00:00Z", "date_only": false, "value": "2022-07-12T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-626", "record": "CERTFR-2022-AVI-626", "field": "revisions.0.revision_date"}, {"timestamp": "2022-07-20T00:00:00Z", "date_only": false, "value": "2022-07-20T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-659", "record": "CERTFR-2022-AVI-659", "field": "revisions.0.revision_date"}, {"timestamp": "2022-07-20T22:00:00Z", "date_only": false, "value": "2022-07-20T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.7.date"}, {"timestamp": "2022-07-25T16:46:59Z", "date_only": false, "value": "2022-07-25T16:46:59.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / vmware", "record": "CVE-2022-22965", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2022-08-09T00:00:00Z", "date_only": false, "value": "2022-08-09T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-716", "record": "CERTFR-2022-AVI-716", "field": "revisions.0.revision_date"}, {"timestamp": "2022-08-13T21:01:28Z", "date_only": false, "value": "2022-08-13T21:01:28.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/poxek/2213", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "d246e9eb-5053-4264-9024-178bf6019237", "content": "Exploit for Code Injection in Vmware Spring Framework CVE-2022-22965\n\n\u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 Spring MVC \u0438\u043b\u0438 Spring WebFlux, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0435 \u043d\u0430 JDK 9+, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445. \u041a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0442\u0440\u0435\u0431\u0443\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u043b\u043e \u043d\u0430 Tomcat \u0432 \u0432\u0438\u0434\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f WAR. \u0415\u0441\u043b\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u043e \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 jar Spring Boot, \u0442.\u0435. \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043e\u043d\u043e \u043d\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430. \u041e\u0434\u043d\u0430\u043a\u043e \u043f\u0440\u0438\u0440\u043e\u0434\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u043e\u043b\u0435\u0435 \u043e\u0431\u0449\u0430\u044f, \u0438 \u043c\u043e\u0433\u0443\u0442 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0435\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f.", "url": "https://t.me/poxek/2213"}, {"timestamp": "2022-08-22T13:00:04Z", "date_only": false, "value": "2022-08-22T13:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/poxek/2334", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "879fbefb-75a1-4235-a7e5-348c08dd4239", "content": "#\u041f\u041e #CVE #POC\n\nSpring4Shell PoC Application\nCVE-2022-22965\n\n\u042d\u0442\u043e \u0434\u043e\u043a\u0435\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043a Spring4Shell. \u041f\u043e\u043b\u043d\u044b\u0439 Java-\u0438\u0441\u0445\u043e\u0434\u043d\u0438\u043a \u0434\u043b\u044f WAR \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d, WAR \u0431\u0443\u0434\u0435\u0442 \u043f\u0435\u0440\u0435\u0441\u043e\u0431\u0438\u0440\u0430\u0442\u044c\u0441\u044f \u043a\u0430\u0436\u0434\u044b\u0439 \u0440\u0430\u0437, \u043a\u043e\u0433\u0434\u0430 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043e\u0431\u0440\u0430\u0437 \u0434\u043e\u043a\u0435\u0440\u0430. \u0421\u043e\u0431\u0440\u0430\u043d\u043d\u044b\u0439 WAR \u0431\u0443\u0434\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d Tomcat.", "url": "https://t.me/poxek/2334"}, {"timestamp": "2022-09-01T22:00:00Z", "date_only": false, "value": "2022-09-01T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.8.date"}, {"timestamp": "2022-09-14T22:00:00Z", "date_only": false, "value": "2022-09-14T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.9.date"}, {"timestamp": "2022-09-20T22:00:00Z", "date_only": false, "value": "2022-09-20T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.10.date"}, {"timestamp": "2022-09-21T22:00:00Z", "date_only": false, "value": "2022-09-21T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.11.date"}, {"timestamp": "2022-10-06T22:00:00Z", "date_only": false, "value": "2022-10-06T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.12.date"}, {"timestamp": "2022-10-11T00:00:00Z", "date_only": false, "value": "2022-10-11T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_siemens \u00b7 SSA-254054", "record": "SSA-254054", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2022-10-11T00:00:00Z", "date_only": false, "value": "2022-10-11T00:00:00Z", "kind": "other", "label": "Updated", "source": "csaf_siemens \u00b7 SSA-254054", "record": "SSA-254054", "field": "document.tracking.current_release_date"}, {"timestamp": "2022-10-12T22:00:00Z", "date_only": false, "value": "2022-10-12T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.13.date"}, {"timestamp": "2022-10-13T00:00:00Z", "date_only": false, "value": "2022-10-13T00:00:00.000000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_cisa \u00b7 ICSA-22-286-05", "record": "ICSA-22-286-05", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-10-13T00:00:00Z", "date_only": false, "value": "2022-10-13T00:00:00.000000Z", "kind": "milestone", "label": "Published", "source": "csaf_cisa \u00b7 ICSA-22-286-05", "record": "ICSA-22-286-05", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-10-13T00:00:00Z", "date_only": false, "value": "2022-10-13T00:00:00.000000Z", "kind": "other", "label": "Updated", "source": "csaf_cisa \u00b7 ICSA-22-286-05", "record": "ICSA-22-286-05", "field": "document.tracking.current_release_date"}, {"timestamp": "2022-10-17T15:19:52Z", "date_only": false, "value": "2022-10-17T15:19:52.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/poxek/2530", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "ae17f6ad-918f-499a-b6f9-afb13c72badb", "content": "CVE-2022-22965 aka Spring4Shell\n\n\u0412 \u043a\u043e\u043d\u0446\u0435 \u043c\u0430\u0440\u0442\u0430 2022 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434  (RCE) \u0432 Java Spring Framework. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0432\u0435\u0431\u0448\u0435\u043b\u043b \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440, \u0434\u043e\u0431\u0438\u0432\u0430\u044f\u0441\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n#\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c  #CVE \n\nCORS | E7 SUBSCRIBE", "url": "https://t.me/poxek/2530"}, {"timestamp": "2022-10-18T22:00:00Z", "date_only": false, "value": "2022-10-18T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.14.date"}, {"timestamp": "2022-10-19T00:00:00Z", "date_only": false, "value": "2022-10-19T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-928", "record": "CERTFR-2022-AVI-928", "field": "revisions.0.revision_date"}, {"timestamp": "2022-10-25T22:00:00Z", "date_only": false, "value": "2022-10-25T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.15.date"}, {"timestamp": "2022-10-26T22:00:00Z", "date_only": false, "value": "2022-10-26T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.16.date"}, {"timestamp": "2022-11-06T23:00:00Z", "date_only": false, "value": "2022-11-06T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.17.date"}, {"timestamp": "2022-11-08T23:00:00Z", "date_only": false, "value": "2022-11-08T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.18.date"}, {"timestamp": "2022-11-15T23:00:00Z", "date_only": false, "value": "2022-11-15T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.19.date"}, {"timestamp": "2022-11-21T23:00:00Z", "date_only": false, "value": "2022-11-21T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.20.date"}, {"timestamp": "2022-11-29T06:36:16Z", "date_only": false, "value": "2022-11-29T06:36:16.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/proxy_bar/1190", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "b0bbf65a-a539-4d5f-9f7b-91bb3c349607", "content": "\u0420\u0430\u043d\u043e\u0432\u0430\u0442\u043e, \u043d\u043e \u0442\u0430\u043a\u0438 \u0434\u0430\n\u0422\u041e\u041f 10 \u0438\u0437 2022\n\n1. Follina (CVE-2022-30190)\n2. Log4Shell (CVE-2021-44228)\n3. Spring4Shell (CVE-2022-22965)\n4. F5 BIG-IP (CVE-2022-1388)\n5. Google Chrome zero-day (CVE-2022-0609)\n6. Old but not forgotten - Microsoft Office bug (CVE-2017-11882)\n7. ProxyNotShell (CVE-2022-41082, CVE-2022-41040)\n8. Zimbra Collaboration Suite bugs (CVE-2022-27925, CVE-2022-41352)\n9. Atlassian Confluence RCE flaw (CVE-2022-26134)\n10. Zyxel RCE vulnerability (CVE-2022-30525)", "url": "https://t.me/proxy_bar/1190"}, {"timestamp": "2022-11-29T07:00:36Z", "date_only": false, "value": "2022-11-29T07:00:36.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/monkey_hacker/28", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "43dafc2e-657a-411d-a892-6011d8f9281c", "content": "\u0420\u0430\u043d\u043e\u0432\u0430\u0442\u043e, \u043d\u043e \u0442\u0430\u043a\u0438 \u0434\u0430\n\u0422\u041e\u041f 10 \u0438\u0437 2022\n\n1. Follina (CVE-2022-30190)\n2. Log4Shell (CVE-2021-44228)\n3. Spring4Shell (CVE-2022-22965)\n4. F5 BIG-IP (CVE-2022-1388)\n5. Google Chrome zero-day (CVE-2022-0609)\n6. Old but not forgotten - Microsoft Office bug (CVE-2017-11882)\n7. ProxyNotShell (CVE-2022-41082, CVE-2022-41040)\n8. Zimbra Collaboration Suite bugs (CVE-2022-27925, CVE-2022-41352)\n9. Atlassian Confluence RCE flaw (CVE-2022-26134)\n10. Zyxel RCE vulnerability (CVE-2022-30525)", "url": "https://t.me/monkey_hacker/28"}, {"timestamp": "2022-12-05T04:24:48Z", "date_only": false, "value": "2022-12-05T04:24:48.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/Al5s1pu9DlCNMnH7rJt2q5NFKP_tt6i0TJLpRuR3HfdnDhA", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "58176737-51e0-4c9d-8c50-850ab0e8641a"}, {"timestamp": "2022-12-06T17:10:12Z", "date_only": false, "value": "2022-12-06T17:10:12.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/8yasABRsBeQ7_fA7ekcVN5-Bf6YalSSK4RwFtvSF2nNKkrM", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "722e6b3d-b9dc-49a2-95a4-262f81ef0a6d"}, {"timestamp": "2022-12-07T23:00:00Z", "date_only": false, "value": "2022-12-07T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.21.date"}, {"timestamp": "2022-12-15T23:00:00Z", "date_only": false, "value": "2022-12-15T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.22.date"}, {"timestamp": "2022-12-16T15:56:36Z", "date_only": false, "value": "2022-12-16T15:56:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/package_security/17", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "8f67f801-173a-489a-9390-c8046a3c1e90", "content": "\u200b\ud83c\udfc6 \u0418\u0442\u043e\u0433\u0438 \u0433\u043e\u0434\u0430\n\n\u041d\u0430\u0441\u0442\u0430\u043b\u043e \u0432\u0440\u0435\u043c\u044f \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u0440\u0430\u0431\u043e\u0447\u0435\u043c \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u0435.\n2\u043a22 \u0433\u043e\u0434 \u043d\u0430\u043a\u043e\u043d\u0435\u0446-\u0442\u043e \u043f\u043e\u0434\u0445\u043e\u0434\u0438\u0442 \u043a \u043a\u043e\u043d\u0446\u0443, \u0430 \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442, \u0447\u0442\u043e \u043f\u043e\u0440\u0430 \u043f\u043e\u0434\u0432\u043e\u0434\u0438\u0442\u044c \u0438\u0442\u043e\u0433\u0438.\n\n\u0423 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u043e\u0432, \u043a\u0430\u043a \u0438 \u0432\u0441\u0435\u0433\u0434\u0430, \u0438\u0442\u043e\u0433\u0438 \u0441\u0432\u043e\u0438. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u0435\u0440\u0436\u0438\u0442\u0435 \u0422\u041e\u041f-10 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 Cyber Threat Intelligence:\n\n1. Follina (CVE-2022-30190) \n\n2. Log4Shell (CVE-2021-44228) \n\n3. Spring4Shell (CVE-2022-22965) \n\n4. F5 BIG-IP (CVE-2022-1388) \n\n5. Google Chrome zero-day (CVE-2022-0609) \n\n6. Old but not forgotten - Microsoft Office bug (CVE-2017-11882) \n\n7. ProxyNotShell (CVE-2022-41082, CVE-2022-41040) \n\n8. Zimbra Collaboration Suite bugs (CVE-2022-27925, CVE-2022-41352) \n\n9. Atlassian Confluence RCE flaw (CVE-2022-26134) \n\n10. Zyxel RCE vulnerability (CVE-2022-30525)\n\n\u0411\u0443\u0434\u044c\u0442\u0435 \u043e\u0441\u0442\u043e\u0440\u043e\u0436\u043d\u044b, \u0431\u0435\u0440\u0435\u0433\u0438\u0442\u0435 \u0441\u0435\u0431\u044f \u0438 \u0432\u0430\u0448\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u044b.\nP.S. \u041d\u0438\u0436\u0435 \u0435\u0441\u0442\u044c \u043f\u0438\u043a\u0447\u0430 \u0441 \u043d\u0430\u0433\u043b\u044f\u0434\u043d\u044b\u043c\u0438 \u0438\u043a\u043e\u043d\u043a\u0430\u043c\u0438\n\n#\u041f\u043e\u043b\u0435\u0437\u043d\u043e\u0435\n\n\u041f\u0430\u043a\u0435\u0442 \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438", "url": "https://t.me/package_security/17"}, {"timestamp": "2022-12-22T16:20:15Z", "date_only": false, "value": "2022-12-22T16:20:15.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/DailyToolz/563", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "ed8f6270-0b84-4cb6-911f-4f4864ccd1e9", "content": "Spring4Shell 0Day Exploit RCE\nCVE-2022-22965\n\nDetails: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities\n\nRequirements:\n- Python3 + pip install requests\n\nCommand : \npython exploit.py --url \"http://site.com\"\n\nAcces shell :\nsite.com//shell.jsp?cmd=id\n\nDownload : in comment\n\n#DontForgetToShare", "url": "https://t.me/DailyToolz/563"}, {"timestamp": "2022-12-22T17:52:36Z", "date_only": false, "value": "2022-12-22T17:52:36.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/eaglecyberwashere/63", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "bcb0ac31-ac9a-40ed-ab1b-9c2f63a9d6be", "content": "Spring4Shell 0Day Exploit RCE\nCVE-2022-22965\n\nDetails: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities\n\nRequirements:\n- Python3 + pip install requests\n\nCommand : \npython exploit.py --url \"http://site.com\"\n\nAcces shell :\nste.com//shell.jsp?cmd=id\n\nDownload : in comment\n\n#DontForgetToShare", "url": "https://t.me/eaglecyberwashere/63"}, {"timestamp": "2022-12-29T02:21:20Z", "date_only": false, "value": "2022-12-29T02:21:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/3647", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "d714557b-2be3-4aef-9c4c-a2c108aa3aea", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1a\u6f0f\u6d1e\u5229\u7528\n\u63cf\u8ff0\uff1aCVE-2022-22965\\\\Spring-Core-RCE\u6838\u5f39\u7ea7\u522b\u6f0f\u6d1e\u7684rce\u56fe\u5f62\u5316GUI\u4e00\u952e\u5229\u7528\u5de5\u5177\uff0c\u57fa\u4e8eJavaFx\u5f00\u53d1\uff0c\u56fe\u5f62\u5316\u64cd\u4f5c\u66f4\u7b80\u5355\uff0c\u63d0\u9ad8\u6548\u7387\u3002\nURL\uff1ahttps://github.com/zangcc/CVE-2022-22965-rexbb\n\n\u6807\u7b7e\uff1a#\u6f0f\u6d1e\u5229\u7528", "url": "https://t.me/GithubRedTeam/3647"}, {"timestamp": "2023-01-03T23:00:00Z", "date_only": false, "value": "2023-01-03T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-0016", "record": "WID-SEC-W-2023-0016", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-01-03T23:00:00Z", "date_only": false, "value": "2023-01-03T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-0016", "record": "WID-SEC-W-2023-0016", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-01-03T23:00:00Z", "date_only": false, "value": "2023-01-03T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-0016", "record": "WID-SEC-W-2023-0016", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2023-01-03T23:00:00Z", "date_only": false, "value": "2023-01-03T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-0016", "record": "WID-SEC-W-2023-0016", "field": "document.tracking.current_release_date"}, {"timestamp": "2023-01-04T10:02:38Z", "date_only": false, "value": "2023-01-04T10:02:38.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/LearnExploit/4351", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "4a85a3d0-c53e-4036-875e-5e34d38b527d", "content": "1. Follina (CVE-2022-30190)\n\n2. Log4Shell (CVE-2021-44228)\n\n3. Spring4Shell (CVE-2022-22965)\n\n4. F5 BIG-IP (CVE-2022-1388)\n\n5. Google Chrome zero-day (CVE-2022-0609)\n\n6. Old but not forgotten - Microsoft Office bug (CVE-2017-11882)\n\n7. ProxyNotShell (CVE-2022-41082, CVE-2022-41040)\n\n8. Zimbra Collaboration Suite bugs (CVE-2022-27925, CVE-2022-41352)\n\n9. Atlassian Confluence RCE flaw (CVE-2022-26134)\n\n10. Zyxel RCE vulnerability (CVE-2022-30525)\n\n#Exploit \n\u2014\u2014\u2014\u2014\u2014\u2014\n0Day.Today\n@LearnExploit\n@Tech_Army", "url": "https://t.me/LearnExploit/4351"}, {"timestamp": "2023-01-05T21:50:44Z", "date_only": false, "value": "2023-01-05T21:50:44.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/RESOLUTEATTACK/303", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "82a338ab-4d81-442f-a1fb-66cdb8fec9da", "content": "CVE-2022-22965 aka Spring4Shell\n\n\u0412 \u043a\u043e\u043d\u0446\u0435 \u043c\u0430\u0440\u0442\u0430 2022 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434  (RCE) \u0432 Java Spring Framework. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0432\u0435\u0431\u0448\u0435\u043b\u043b \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440, \u0434\u043e\u0431\u0438\u0432\u0430\u044f\u0441\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435\n\n#\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438  #CVE \n\nCORS | E7 SUBSCRIBE", "url": "https://t.me/RESOLUTEATTACK/303"}, {"timestamp": "2023-01-17T23:00:00Z", "date_only": false, "value": "2023-01-17T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-0139", "record": "WID-SEC-W-2023-0139", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-01-17T23:00:00Z", "date_only": false, "value": "2023-01-17T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-0139", "record": "WID-SEC-W-2023-0139", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-01-17T23:00:00Z", "date_only": false, "value": "2023-01-17T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-0139", "record": "WID-SEC-W-2023-0139", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2023-01-17T23:00:00Z", "date_only": false, "value": "2023-01-17T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-0139", "record": "WID-SEC-W-2023-0139", "field": "document.tracking.current_release_date"}, {"timestamp": "2023-02-06T23:00:00Z", "date_only": false, "value": "2023-02-06T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.23.date"}, {"timestamp": "2023-02-09T00:00:00Z", "date_only": false, "value": "2023-02-09T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_update_date.data.1.date"}, {"timestamp": "2023-02-09T02:07:00Z", "date_only": false, "value": "2023-02-09T02:07Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2022-22965", "record": "GSD-2022-22965", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2023-02-09T02:07:02.263Z", "date_only": false, "value": "2023-02-09T02:07:02.263000", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_update_date.data.5.date"}, {"timestamp": "2023-02-09T15:14:14Z", "date_only": false, "value": "2023-02-09T15:14:14+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.revision_history.13.date"}, {"timestamp": "2023-02-09T15:14:14Z", "date_only": false, "value": "2023-02-09T15:14:14+00:00", "kind": "other", "label": "Updated", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.current_release_date"}, {"timestamp": "2023-02-09T15:14:26Z", "date_only": false, "value": "2023-02-09T15:14:26+00:00", "kind": "other", "label": "Document generated", "source": "csaf_cisco \u00b7 CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "record": "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67", "field": "document.tracking.generator.date"}, {"timestamp": "2023-02-22T23:00:00Z", "date_only": false, "value": "2023-02-22T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.24.date"}, {"timestamp": "2023-04-18T22:00:00Z", "date_only": false, "value": "2023-04-18T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-1012", "record": "WID-SEC-W-2023-1012", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-04-18T22:00:00Z", "date_only": false, "value": "2023-04-18T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-1016", "record": "WID-SEC-W-2023-1016", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2023-04-18T22:00:00Z", "date_only": false, "value": "2023-04-18T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-1012", "record": "WID-SEC-W-2023-1012", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-04-18T22:00:00Z", "date_only": false, "value": "2023-04-18T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-1016", "record": "WID-SEC-W-2023-1016", "field": "document.tracking.initial_release_date"}, {"timestamp": "2023-04-18T22:00:00Z", "date_only": false, "value": "2023-04-18T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-1012", "record": "WID-SEC-W-2023-1012", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2023-04-18T22:00:00Z", "date_only": false, "value": "2023-04-18T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-1016", "record": "WID-SEC-W-2023-1016", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2023-04-18T22:00:00Z", "date_only": false, "value": "2023-04-18T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-1012", "record": "WID-SEC-W-2023-1012", "field": "document.tracking.current_release_date"}, {"timestamp": "2023-06-14T21:10:04Z", "date_only": false, "value": "2023-06-14T21:10:04.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "5690b24d-8171-43ff-b659-fe6d30392800"}, {"timestamp": "2023-06-28T00:00:00Z", "date_only": false, "value": "2023-06-28T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "sources_update_date.data.4.date"}, {"timestamp": "2023-09-20T16:07:48Z", "date_only": false, "value": "2023-09-20T16:07:48.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CNArsenal/1148", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "a86d4936-65be-4e79-9447-e25611fb794d", "content": "https://github.com/zangcc/CVE-2022-22965-rexbb\nCVE-2022-22965\\Spring-Core-RCE\u56fe\u5f62\u5316GUI\u4e00\u952e\u5229\u7528\u5de5\u5177\n#github  #tools", "url": "https://t.me/CNArsenal/1148"}, {"timestamp": "2023-09-29T16:22:10Z", "date_only": false, "value": "2023-09-29T16:22:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/scnVkFfAGTbQlKqoB-no-oQI8cQLsl_kXBoyZPiIU-BtIvU", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "5167894f-7f60-45db-b1b1-3d6195ef88e8"}, {"timestamp": "2023-09-29T17:25:40Z", "date_only": false, "value": "2023-09-29T17:25:40.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Redscriptteam/3962", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "fdc846f5-65fb-46cd-bb7f-91eb2335a3bb", "content": "RCE graphical GUI one-click exploitation tool\n\nhttps://github.com/zangcc/CVE-2022-22965-rexbb\nCVE-2022-22965\\Spring-Core-\n\nPrivate: @vpn809", "url": "https://t.me/Redscriptteam/3962"}, {"timestamp": "2023-10-14T14:57:27Z", "date_only": false, "value": "2023-10-14T14:57:27+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2022-22965", "field": "timestamps.asserted_at", "uuid": "6b19bd2d-6d06-4430-8ce2-55e417011a01", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2023-10-14T14:57:27Z", "date_only": false, "value": "2023-10-14T14:57:27+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2022-22965", "field": "timestamps.first_seen_at", "uuid": "6b19bd2d-6d06-4430-8ce2-55e417011a01", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2023-11-02T13:56:07Z", "date_only": false, "value": "2023-11-02T13:56:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CNArsenal/1418", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "60096d75-29bf-4576-ae30-aba114951d95", "content": "https://github.com/sule01u/SBSCAN\nspring \u6e17\u900f\u6d4b\u8bd5\u6846\u67b6 \u652f\u6301\nCVE-2018-1273\nCVE-2019-3799\nCVE-2020-5410\nCVE-2022-22947\nCVE-2022-22963\nCVE-2022-22965\n\n#github #tools", "url": "https://t.me/CNArsenal/1418"}, {"timestamp": "2023-11-02T15:04:03Z", "date_only": false, "value": "2023-11-02T15:04:03.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/cJEcDU9cf4Dk8Ba7quvMkUZfv4A1JE3RWzAD-VOFLtw7nw", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "9ed11764-1a62-4c79-aa1a-6e4a883379b5"}, {"timestamp": "2023-11-03T08:19:51Z", "date_only": false, "value": "2023-11-03T08:19:51.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/WARLOCK_DARK_ARMY_OFFICIALS/3510", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "48793a93-7abe-41b2-bca9-c07bfa2900ae", "content": "https://github.com/sule01u/SBSCAN\n\nspring Penetration testing framework support\nCVE-2018-1273\nCVE-2019-3799\nCVE-2020-5410\nCVE-2022-22947\nCVE-2022-22963\nCVE-2022-22965", "url": "https://t.me/WARLOCK_DARK_ARMY_OFFICIALS/3510"}, {"timestamp": "2023-11-09T13:13:12Z", "date_only": false, "value": "2023-11-09T13:13:12.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/purple_medved/147", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "ef6dde3b-4435-4519-a20c-f6980d30f045", "content": "Netlas CookBook\n\n\u042f \u0443\u0436\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437 \u043f\u0438\u0441\u0430\u043b \u043f\u0440\u043e Netlas, \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 \u0440\u0435\u0431\u044f\u0442\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0433\u0430\u0439\u0434 \u043a\u0430\u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c \u043d\u0430 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0445 \u043f\u0440\u0438\u043c\u0435\u0440\u0430\u0445, \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0441 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u0441\u043a\u0440\u0438\u043f\u0442\u044b \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u0434\u0440\u0443\u0433\u043e\u0435 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0435.\n\n\u0418\u0437 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u0441\u0435\u0431\u044f \u0432\u044b\u0434\u0435\u043b\u0438\u043b:\nPentest\nSearch subdomains - netlas search \"domain:*.github.com OR host:*.github.com\" -f json\nSearch for sites with specific vulnerabilities - netlas search \"cve.name:CVE-2022-22965\" -f json\nSearch for sites with vulnerabilities that contain a certain word in their descriptions - netlas search \"cve.description:weblogic AND cve.has_exploit:true\" -f json\nSearch by server http header - netlas search 'http.headers.server:\"yawcam\"' -f json\nSearch servers with CVEs by favicon hash - netlas search \"http.favicon.hash_sha256:ebaaed8ab7c21856f888117edaf342f6bc10335106ed907f95787b69878d9d9e\" -f json\nSearch servers with CVEs by tag name - netlas search 'tag.name:\"adobe_coldfusion\"' -f json\nSearch vulnerable servers and devices near you (or any other location) - geo.city:London AND cve:*\nSearch for login/admin panels - http.title:admin http.title:panel\nSearch for vulnerable database admin panels - http.title:(phpPgAdmin OR pgadmin) cve:*\nSearch for sites vulnerable to SQL injection - netlas search \"http.body:mysql_fetch_array http.body:warning\" -f json\n\nOSINT\nSearch person's nickname or email in WHOIS contacts - netlas search \"whois.related_nets.contacts.emails:sweetwater*\" -f json\nSearch person's nickname or email in title and body of web page - netlas search \"http.title:sweetwater OR http.body:sweetwater\" -f json\nSearch links to \"juicy info files\" on subdomains of the company's website - netlas search \"uri:*lidl.* AND http.body:pdf\"\nPhone number mentions search - netlas search \"http.body:1?234?567?89?99 OR http.body:12345678999 OR http.body:1234?5678?999\" -f json\nSearch file mentions (looking for content that may be infringing on copyrights) - netlas search \"(http.title:alla OR http.body:alla) AND http.body:*.mp3\" -f json\nDomain WHOIS information gathering - netlas host github.com -f json\nSearch by FTP server's banners text - netlas search 'ftp.banner:\"Collado\"' -f json\nSearch for contact information in SSL certificates - netlas search \"certificate.issuer.street_address:*mcgill*\" -f json\nUsing Netlas as an alternative to the WayBack Machine - http.title:\"github.com\"\nSearch related websites - http.body:UA-23870775\n\nCrypto Investigations\nSearch mining farms - http.headers.www_authenticate:XMR-Stak-Miner\nSearch for websites infected with cryptominers - netlas search \"http.body:coinhive.min.js domain:*\"\nSearch vulnerable Bitcoin nodes - netlas search \"port:8333 cve:*\"\n\n#netlas #assets_management #subdomains_enum", "url": "https://t.me/purple_medved/147"}, {"timestamp": "2023-11-09T15:15:24Z", "date_only": false, "value": "2023-11-09T15:15:24.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/zQEct_B6_afl0ZrnDAVic-SCcczOhA723w0bBoq0o0P4", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "40efd127-fd0b-490d-acf5-77b2ca1f9704"}, {"timestamp": "2023-11-12T22:17:05Z", "date_only": false, "value": "2023-11-12T22:17:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/5775", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "d632481b-6dfa-4482-9b7c-079b727cd8e5", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aSpring4Shell Vulnerability RCE\nURL\uff1ahttps://github.com/LucasPDiniz/CVE-2022-22965\n\n\u6807\u7b7e\uff1a#RCE", "url": "https://t.me/GithubRedTeam/5775"}, {"timestamp": "2023-11-13T06:33:24Z", "date_only": false, "value": "2023-11-13T06:33:24.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/154", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "364555ea-224a-437f-a758-04a7eef51e67", "content": "#ExploitObserverAlert\n\nCVE-2022-22965\n\nDESCRIPTION: Exploit Observer has 359 entries related to CVE-2022-22965. A Spring MVC or Spring WebFlux application running on JDK 9  may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.\n\nFIRST-EPSS: 0.975020000\nNVD-IS: 5.9\nNVD-ES: 3.9", "url": "https://t.me/arpsyndicate/154"}, {"timestamp": "2023-11-20T04:04:42Z", "date_only": false, "value": "2023-11-20T04:04:42.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/KY4PVd45dzhnz_l3x8aBIZwbkHWB1w1Cp1_7dnD8vo88jQ", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "b842ee8b-e3fd-470b-9128-c1d6bb086e91"}, {"timestamp": "2023-12-03T00:54:09Z", "date_only": false, "value": "2023-12-03T00:54:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/907", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "d84bdba9-bc9b-4d44-a97a-781629b06bb4", "content": "#ExploitObserverAlert\n\nCVE-2022-22965\n\nDESCRIPTION: Exploit Observer has 363 entries related to CVE-2022-22965. A Spring MVC or Spring WebFlux application running on JDK 9  may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.\n\nFIRST-EPSS: 0.974510000\nNVD-IS: 5.9\nNVD-ES: 3.9", "url": "https://t.me/arpsyndicate/907"}, {"timestamp": "2023-12-13T01:19:29.980Z", "date_only": false, "value": "2023-12-13T01:19:29.980385Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-22965", "record": "GSD-2022-22965", "field": "gsd.osvSchema.modified"}, {"timestamp": "2023-12-26T23:00:00Z", "date_only": false, "value": "2023-12-26T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-1016", "record": "WID-SEC-W-2023-1016", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2023-12-26T23:00:00Z", "date_only": false, "value": "2023-12-26T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-1016", "record": "WID-SEC-W-2023-1016", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-01-11T14:10:58Z", "date_only": false, "value": "2024-01-11T14:10:58.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/be71b4bd-4071-4e17-bb48-01ca64164811", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "64232a2c-9ac3-4dd2-bb99-d20f83b0763d"}, {"timestamp": "2024-01-25T20:10:56.055Z", "date_only": false, "value": "2024-01-25T20:10:56.055000Z", "kind": "other", "label": "Last update date", "source": "variot \u00b7 VAR-202203-1506", "record": "VAR-202203-1506", "field": "last_update_date"}, {"timestamp": "2024-02-06T09:03:50Z", "date_only": false, "value": "2024-02-06T09:03:50.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/6570", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "5c81e0c2-b388-4483-9702-dcbafc3d8076", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1a\u4e00\u6b3eSpring\u7efc\u5408\u6f0f\u6d1e\u7684\u5229\u7528\u5de5\u5177\uff0c\u5de5\u5177\u76ee\u524d\u652f\u6301Spring Cloud Gateway RCE(CVE-2022-22947)\u3001Spring Framework RCE (CVE-2022-22965) \u7684\u68c0\u6d4b\u4ee5\u53ca\u5229\u7528\uff0c\u76ee\u524d\u4ec5\u4e3a\u7b2c\u4e00\u4e2a\u7248\u672c\uff0c\u540e\u7eed\u4f1a\u6dfb\u52a0\u66f4\u591a\u6f0f\u6d1ePOC\uff0c\u4ee5\u53ca\u66f4\u591a\u7684\u6301\u4e45\u5316\u5229\u7528\u65b9\u5f0f\nURL\uff1ahttps://github.com/charonlight/SpringExploitGUI\n\n\u6807\u7b7e\uff1a#RCE", "url": "https://t.me/GithubRedTeam/6570"}, {"timestamp": "2024-02-07T09:17:47Z", "date_only": false, "value": "2024-02-07T09:17:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CNArsenal/1965", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "c04d5bce-1b75-4c89-8682-f46453f60017", "content": "https://github.com/charonlight/SpringExploitGUI?tab=readme-ov-file\n\n\u4e00\u6b3eSpring\u7efc\u5408\u6f0f\u6d1e\u5229\u7528\u5de5\u5177 \u652f\u6301Spring Cloud Gateway RCE(CVE-2022-22947)\u3001Spring Framework RCE (CVE-2022-22965) \u7684\u6279\u91cf\u68c0\u6d4b\u4ee5\u53ca\u5229\u7528\n#github #tools #Java", "url": "https://t.me/CNArsenal/1965"}, {"timestamp": "2024-02-29T23:00:00Z", "date_only": false, "value": "2024-02-29T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-0528", "record": "WID-SEC-W-2024-0528", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-02-29T23:00:00Z", "date_only": false, "value": "2024-02-29T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-0528", "record": "WID-SEC-W-2024-0528", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-02-29T23:00:00Z", "date_only": false, "value": "2024-02-29T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-0528", "record": "WID-SEC-W-2024-0528", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2024-02-29T23:00:00Z", "date_only": false, "value": "2024-02-29T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-0528", "record": "WID-SEC-W-2024-0528", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-03-15T08:58:02Z", "date_only": false, "value": "2024-03-15T08:58:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pt_soft/243", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "fa0708f8-750a-4491-afff-4a9f13ca59cc", "content": "\ud83d\uddbc\ufe0f Moriarty v1.1\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f // Pentest HaT \ud83c\udfa9", "url": "https://t.me/pt_soft/243"}, {"timestamp": "2024-05-03T09:04:40Z", "date_only": false, "value": "2024-05-03T09:04:40.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/pt_soft/270", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "e4243429-dd03-4d69-b8a2-1437ac44e4e1", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f // Pentest HaT \ud83c\udfa9", "url": "https://t.me/pt_soft/270"}, {"timestamp": "2024-05-28T22:00:00Z", "date_only": false, "value": "2024-05-28T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.25.date"}, {"timestamp": "2024-08-03T03:28:42.725Z", "date_only": false, "value": "2024-08-03T03:28:42.725Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2022-22965", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-15T17:40:42.367Z", "date_only": false, "value": "2024-08-15T17:40:42.367+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-0016", "record": "WID-SEC-W-2023-0016", "field": "document.tracking.generator.date"}, {"timestamp": "2024-08-15T17:41:53.590Z", "date_only": false, "value": "2024-08-15T17:41:53.590+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-0139", "record": "WID-SEC-W-2023-0139", "field": "document.tracking.generator.date"}, {"timestamp": "2024-08-15T17:49:12.744Z", "date_only": false, "value": "2024-08-15T17:49:12.744+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-1012", "record": "WID-SEC-W-2023-1012", "field": "document.tracking.generator.date"}, {"timestamp": "2024-08-15T17:49:14.060Z", "date_only": false, "value": "2024-08-15T17:49:14.060+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-1016", "record": "WID-SEC-W-2023-1016", "field": "document.tracking.generator.date"}, {"timestamp": "2024-08-15T18:05:58.480Z", "date_only": false, "value": "2024-08-15T18:05:58.480+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-0528", "record": "WID-SEC-W-2024-0528", "field": "document.tracking.generator.date"}, {"timestamp": "2024-08-16T08:28:17Z", "date_only": false, "value": "2024-08-16T08:28:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Rootsec_2/1046", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "a7538af8-4717-45dc-9314-a8475b517bdc", "content": "https://github.com/zangcc/CVE-2022-22965-rexbb\nCVE-2022-22965\\Spring-Core-RCE\u56fe\u5f62\u5316GUI\u4e00\u952e\u5229\u7528\u5de5\u5177\n#github  #tools", "url": "https://t.me/Rootsec_2/1046"}, {"timestamp": "2024-08-29T06:23:17Z", "date_only": false, "value": "2024-08-29T06:23:17.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ARC15INFO/301", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "1ce91e10-bcd7-4a5f-89a8-fc19aa492edf", "content": "New Spring Framework RCE  Vulnerability Confirmed - What to do?\n\nEarly Wednesday morning (GMT), allegations began to appear on the internet about a new remote code execution flaw that affects Spring Framework. This vulnerability, dubbed by some as \"Springshell\" in the community, is a new, previously unknown security vulnerability. It has been added to Sonatype data as SONATYPE-2022-1764 and given the designation CVE-2022-22965. Spring have acknowledged the vulnerability and released 5.3.18 and 5.2.20 to patch the issue. We recommend an immediate upgrade for all users.\n\nNOTE: A separate Spring vulnerability CVE-2022-22963 (High) disclosed a few days ago impacts Spring Cloud Function. This is a Spring Expression language SpEL vulnerability in Spring Cloud Function and is NOT related to \"Springshell\" that impacts Spring.\n\nhttps://blog.sonatype.com/new-0-day-spring-framework-vulnerability-confirmed\n\n\ud83d\udce1@cRyPtHoN_INFOSEC_FR\n\ud83d\udce1@cRyPtHoN_INFOSEC_EN\n\ud83d\udce1@cRyPtHoN_INFOSEC_DE\n\ud83d\udce1@BlackBox_Archiv", "url": "https://t.me/ARC15INFO/301"}, {"timestamp": "2024-08-29T06:23:17Z", "date_only": false, "value": "2024-08-29T06:23:17.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ARC15INFO/331", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "1e1be19e-fff7-4bb9-a8dd-b0c8323f0611", "content": "Spring4Shell (CVE-2022-22965): details and mitigations.\n\nLast week researchers found the critical vulnerability CVE-2022-22965 in Spring \u2013 the open source Java framework. Using the vulnerability, an attacker can execute arbitrary code on a remote web server, which makes CVE-2022-22965 a critical threat, given the Spring framework\u2019s popularity. By analogy with the infamous Log4Shell threat, the vulnerability was named Spring4Shell.\n\nCVE-2022-22965 and CVE-2022-22963: technical details\n\nCVE-2022-22965 (Spring4Shell, SpringShell) is a vulnerability in the Spring Framework that uses data binding functionality to bind data stored within an HTTP request to certain objects used by an application. The bug exists in the getCachedIntrospectionResults method, which can be used to gain unauthorized access to such objects by passing their class names via an HTTP request.\n\nhttps://securelist.com/spring4shell-cve-2022-22965/106239/\n\n\ud83d\udce1@cRyPtHoN_INFOSEC_FR\n\ud83d\udce1@cRyPtHoN_INFOSEC_EN\n\ud83d\udce1@cRyPtHoN_INFOSEC_DE\n\ud83d\udce1@BlackBox_Archiv", "url": "https://t.me/ARC15INFO/331"}, {"timestamp": "2024-10-11T03:03:25Z", "date_only": false, "value": "2024-10-11T03:03:25.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberSecurityTechnologies/7395", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "60b4eb1e-5dda-4d3e-8205-d01bb7a58374", "content": "#Analytics\nTop 10 most exploited vulnerabilities in 2022\n\n1. CVE-2022-30190: MS Office \"Follina\"\n2. CVE-2021-44228: Apache Log4Shell\n3. CVE-2022-22965: Spring4Shell\n4. CVE-2022-1388: F5 BIG-IP\n5. CVE-2022-0609: Google Chrome 0-day\n6. CVE-2017-11882: MS Office RCE\n7. CVE-2022-41082, CVE-2022-41040: ProxyNotShell\n8. CVE-2022-27925, CVE-2022-41352: Zimbra Collaboration Suite bugs\n9. CVE-2022-26134: Atlassian Confluence RCE\n10. CVE-2022-30525: Zyxel RCE vulnerability", "url": "https://t.me/CyberSecurityTechnologies/7395"}, {"timestamp": "2024-10-25T00:00:00Z", "date_only": false, "value": "2024-10-25T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2024-10-25)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "c0785919-82d0-4ee7-a020-22e76b0f66ba"}, {"timestamp": "2024-11-22T18:53:08Z", "date_only": false, "value": "2024-11-22T18:53:08+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022_1306", "record": "RHSA-2022_1306", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2024-11-22T18:53:08Z", "date_only": false, "value": "2024-11-22T18:53:08+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2022_1306", "record": "RHSA-2022_1306", "field": "document.tracking.generator.date"}, {"timestamp": "2024-11-22T18:53:08Z", "date_only": false, "value": "2024-11-22T18:53:08+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2022_1306", "record": "RHSA-2022_1306", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-11-22T18:53:16Z", "date_only": false, "value": "2024-11-22T18:53:16+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022_1333", "record": "RHSA-2022_1333", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2024-11-22T18:53:16Z", "date_only": false, "value": "2024-11-22T18:53:16+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2022_1333", "record": "RHSA-2022_1333", "field": "document.tracking.generator.date"}, {"timestamp": "2024-11-22T18:53:16Z", "date_only": false, "value": "2024-11-22T18:53:16+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2022_1333", "record": "RHSA-2022_1333", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-11-22T18:53:24Z", "date_only": false, "value": "2024-11-22T18:53:24+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022_1360", "record": "RHSA-2022_1360", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2024-11-22T18:53:24Z", "date_only": false, "value": "2024-11-22T18:53:24+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2022_1360", "record": "RHSA-2022_1360", "field": "document.tracking.generator.date"}, {"timestamp": "2024-11-22T18:53:24Z", "date_only": false, "value": "2024-11-22T18:53:24+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2022_1360", "record": "RHSA-2022_1360", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-11-22T18:53:32Z", "date_only": false, "value": "2024-11-22T18:53:32+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022_1379", "record": "RHSA-2022_1379", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2024-11-22T18:53:32Z", "date_only": false, "value": "2024-11-22T18:53:32+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2022_1379", "record": "RHSA-2022_1379", "field": "document.tracking.generator.date"}, {"timestamp": "2024-11-22T18:53:32Z", "date_only": false, "value": "2024-11-22T18:53:32+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2022_1379", "record": "RHSA-2022_1379", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-11-22T18:53:39Z", "date_only": false, "value": "2024-11-22T18:53:39+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022_1378", "record": "RHSA-2022_1378", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2024-11-22T18:53:39Z", "date_only": false, "value": "2024-11-22T18:53:39+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2022_1378", "record": "RHSA-2022_1378", "field": "document.tracking.generator.date"}, {"timestamp": "2024-11-22T18:53:39Z", "date_only": false, "value": "2024-11-22T18:53:39+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2022_1378", "record": "RHSA-2022_1378", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-11-22T18:53:46Z", "date_only": false, "value": "2024-11-22T18:53:46+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022_1627", "record": "RHSA-2022_1627", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2024-11-22T18:53:46Z", "date_only": false, "value": "2024-11-22T18:53:46+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2022_1627", "record": "RHSA-2022_1627", "field": "document.tracking.generator.date"}, {"timestamp": "2024-11-22T18:53:46Z", "date_only": false, "value": "2024-11-22T18:53:46+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2022_1627", "record": "RHSA-2022_1627", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-11-22T18:53:54Z", "date_only": false, "value": "2024-11-22T18:53:54+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022_1626", "record": "RHSA-2022_1626", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2024-11-22T18:53:54Z", "date_only": false, "value": "2024-11-22T18:53:54+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2022_1626", "record": "RHSA-2022_1626", "field": "document.tracking.generator.date"}, {"timestamp": "2024-11-22T18:53:54Z", "date_only": false, "value": "2024-11-22T18:53:54+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2022_1626", "record": "RHSA-2022_1626", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-12-18T23:00:00Z", "date_only": false, "value": "2024-12-18T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.revision_history.16.date"}, {"timestamp": "2024-12-18T23:00:00Z", "date_only": false, "value": "2024-12-18T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-12-19T09:19:52.335Z", "date_only": false, "value": "2024-12-19T09:19:52.335+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0033", "record": "WID-SEC-W-2022-0033", "field": "document.tracking.generator.date"}, {"timestamp": "2024-12-21T15:49:29Z", "date_only": false, "value": "2024-12-21T15:49:29.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ckeArsenal/101", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "81ca2836-a62e-4756-ac4a-43a155dcf505", "content": "https://github.com/charonlight/SpringExploitGUI?tab=readme-ov-file\n\n\u4e00\u6b3eSpring\u7efc\u5408\u6f0f\u6d1e\u5229\u7528\u5de5\u5177 \u652f\u6301Spring Cloud Gateway RCE(CVE-2022-22947)\u3001Spring Framework RCE (CVE-2022-22965) \u7684\u6279\u91cf\u68c0\u6d4b\u4ee5\u53ca\u5229\u7528\n#github #tools #Java", "url": "https://t.me/ckeArsenal/101"}, {"timestamp": "2024-12-22T00:00:00Z", "date_only": false, "value": "2024-12-22T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2024-12-22)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "747900cd-4d23-4534-b954-772c9d172f08"}, {"timestamp": "2024-12-24T20:30:11.768Z", "date_only": false, "value": "2024-12-24T20:30:11.768085Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971497", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "7d126aee-53c9-470e-8803-e7c5836c85d4", "url": "https://feedsin.space/feed/CISAKevBot/items/2971497"}, {"timestamp": "2025-01-07T06:50:33Z", "date_only": false, "value": "2025-01-07T06:50:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/6uuFptL0AU_OXfQ4jiWecY6X8pi_-oVvCdmHzfgcM_ivtPc", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "46480259-1143-4e9b-b616-c37948ec98bc"}, {"timestamp": "2025-01-15T00:00:00Z", "date_only": false, "value": "2025-01-15T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-01-15)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "1d3c7212-b6e4-4177-b4d7-774b237286b4"}, {"timestamp": "2025-01-26T00:00:00Z", "date_only": false, "value": "2025-01-26T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-01-26)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "2e8083a8-b5eb-4c6a-afea-99352efe0c69"}, {"timestamp": "2025-01-29T17:52:10.886Z", "date_only": false, "value": "2025-01-29T17:52:10.886552Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-22965", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2025-01-29T17:52:10.886Z", "date_only": false, "value": "2025-01-29T17:52:10.886552Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-22965", "record": "FKIE_CVE-2022-22965", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-01-29T19:11:20Z", "date_only": false, "value": "2025-01-29T19:11:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/3383", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "b82768aa-eef1-4371-82c6-d867d93bb4f5", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-22965\n\ud83d\udd25 CVSS Score: 9.8 (CVSS_V3)\n\ud83d\udd39 Description: Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as `Spring4Shell`. \n\n## Impact\n\nA Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.\n\nThese are the prerequisites for the exploit:\n- JDK 9 or higher\n- Apache Tomcat as the Servlet container\n- Packaged as WAR\n- `spring-webmvc` or `spring-webflux` dependency\n\n## Patches\n\n- Spring Framework [5.3.18](https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18) and [5.2.20](https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE)\n- Spring Boot [2.6.6](https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6) and [2.5.12](https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12)\n\n## Workarounds\n\nFor those who are unable to upgrade, leaked reports recommend setting `disallowedFields` on `WebDataBinder` through an `@ControllerAdvice`. This works generally, but as a centrally applied workaround fix, may leave some loopholes, in particular if a controller sets `disallowedFields` locally through its own `@InitBinder` method, which overrides the global setting.\n\nTo apply the workaround in a more fail-safe way, applications could extend `RequestMappingHandlerAdapter` to update the `WebDataBinder` at the end after all other initialization. In order to do that, a Spring Boot application can declare a `WebMvcRegistrations` bean (Spring MVC) or a `WebFluxRegistrations` bean (Spring WebFlux).\n\ud83d\udccf Published: 2022-03-31T18:30:50Z\n\ud83d\udccf Modified: 2025-01-29T18:38:36Z\n\ud83d\udd17 References:\n1. https://nvd.nist.gov/vuln/detail/CVE-2022-22965\n2. https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15\n3. https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf\n4. https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12\n5. https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6\n6. https://github.com/spring-projects/spring-framework\n7. https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE\n8. https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18\n9. https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005\n10. https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement\n11. https://tanzu.vmware.com/security/cve-2022-22965\n12. https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67\n13. https://www.kb.cert.org/vuls/id/970766\n14. https://www.oracle.com/security-alerts/cpuapr2022.html\n15. https://www.oracle.com/security-alerts/cpujul2022.html\n16. http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html\n17. http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html", "url": "https://t.me/DarkWebInformer_CVEAlerts/3383"}, {"timestamp": "2025-02-03T16:00:09Z", "date_only": false, "value": "2025-02-03T16:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/gK2RrbPVq5WKWqo6KBx6xshJNMtGXFgsdrpvJzEqhcsPpnE", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "87bdbcc5-3e0b-431e-a573-89fb5251bf0a"}, {"timestamp": "2025-02-06T03:13:45Z", "date_only": false, "value": "2025-02-06T03:13:45.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "647cf77e-f9cd-4c9b-b964-d2b75a9091ea"}, {"timestamp": "2025-02-07T00:00:00Z", "date_only": false, "value": "2025-02-07T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-02-07)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "efb87ec5-45b7-4a19-99f6-48bf5945559e"}, {"timestamp": "2025-02-20T21:57:00Z", "date_only": false, "value": "2025-02-20T21:57:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/BABATATASASA/7356", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "0197fa2c-7822-43f7-867c-63ffc7d9824d", "content": "Spring4Shell (CVE-2022-22965): Are you vulnerable to this Zero Day? - Securin\nhttps://www.securin.io/articles/spring4shell-the-next-log4j/", "url": "https://t.me/BABATATASASA/7356"}, {"timestamp": "2025-02-21T00:00:00Z", "date_only": false, "value": "2025-02-21T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-02-21)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "0a33b146-c9d2-44be-b77a-4f137b797512"}, {"timestamp": "2025-02-23T02:10:35Z", "date_only": false, "value": "2025-02-23T02:10:35.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "ef35beca-0556-49a4-af77-9cbd8be352de"}, {"timestamp": "2025-02-23T04:10:44Z", "date_only": false, "value": "2025-02-23T04:10:44.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "f40a4c03-61cd-4fd7-a079-46880f82e252"}, {"timestamp": "2025-02-25T00:00:00Z", "date_only": false, "value": "2025-02-25T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-02-25)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "901c56bd-aa81-4507-a336-89977e05171f"}, {"timestamp": "2025-02-28T23:49:13.272Z", "date_only": false, "value": "2025-02-28T23:49:13.272798Z", "kind": "sighting", "label": "Seen", "source": "https://vulnerability.circl.lu/bundle/fdda4963-0aa7-4d15-8a8f-969db8f304ca", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "69496ba0-f408-4c5d-a01a-8b8865c7fa51", "url": "https://vulnerability.circl.lu/bundle/fdda4963-0aa7-4d15-8a8f-969db8f304ca"}, {"timestamp": "2025-03-14T00:00:00Z", "date_only": false, "value": "2025-03-14T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-14)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "92d6c54d-2baa-416e-9d8f-4f7e8ad323d3"}, {"timestamp": "2025-03-14T00:00:00Z", "date_only": false, "value": "2025-03-14T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-03-14)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "935680a9-9f0f-42eb-b1f0-a24bc82b0a2e"}, {"timestamp": "2025-05-01T00:00:00Z", "date_only": false, "value": "2025-05-01T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-01)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "8ebce67f-6d81-45b8-8fa2-e44b62008f43"}, {"timestamp": "2025-05-16T00:00:00Z", "date_only": false, "value": "2025-05-16T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-16)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "8fab432d-23a6-410b-9a65-6bb77c7c0c03"}, {"timestamp": "2025-05-28T11:36:21.415Z", "date_only": false, "value": "2025-05-28T11:36:21.415264Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/softwaremill.com/post/3lqa4fgd6ns2l", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "98cd1879-986c-4b13-b70b-c3b0bdf4c1b1", "url": "https://bsky.app/profile/softwaremill.com/post/3lqa4fgd6ns2l"}, {"timestamp": "2025-06-09T00:00:00Z", "date_only": false, "value": "2025-06-09T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-09)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "ac848f1c-95f4-486a-8af3-2d908fb66403"}, {"timestamp": "2025-06-12T03:00:05Z", "date_only": false, "value": "2025-06-12T03:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/pEiL-1XWyM7kvZEnILJ6gHpkCQEoAvLTz0BTuqaqHQsP4KA", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "557fc11b-53cc-4946-914b-0683a648a2ee"}, {"timestamp": "2025-06-22T17:18:20.384Z", "date_only": false, "value": "2025-06-22T17:18:20.384110Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/malmoeb/statuses/114728153853100417", "record": "cve-2022-22965", "field": "creation_timestamp", "uuid": "f15f5b99-a8b0-4e09-b6d9-5eae171a9ac2", "url": "https://infosec.exchange/users/malmoeb/statuses/114728153853100417"}, {"timestamp": "2025-06-28T15:00:05Z", "date_only": false, "value": "2025-06-28T15:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/7uMgWpHzIXHq-VKY85VruH5IgcO7HESNbhCEg894JKVdBb8", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "65b1e5a4-25ba-4507-b039-4e29b6bceae7"}, {"timestamp": "2025-06-29T14:35:27Z", "date_only": false, "value": "2025-06-29T14:35:27.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/42375", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "833dea86-4e64-41d0-bc3f-79a5d315a471", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1a\u6f0f\u6d1e\u5229\u7528\n\u63cf\u8ff0\uff1a\uff08CVE-2022-22965\uff09PoC \u5e94\u7528\u7a0b\u5e8f\u548c\u6f0f\u6d1e\u5229\u7528\nURL\uff1ahttps://github.com/ZapcoMan/spring4shell-vulnerable-application\n\n\u6807\u7b7e\uff1a#\u6f0f\u6d1e\u5229\u7528", "url": "https://t.me/GithubRedTeam/42375"}, {"timestamp": "2025-07-02T00:00:00Z", "date_only": false, "value": "2025-07-02T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-07-02)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "dbd2499a-dc19-43f3-848d-7c7f90fce6e6"}, {"timestamp": "2025-07-03T00:00:00Z", "date_only": false, "value": "2025-07-03T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-07-03)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "228ad9aa-3e1a-4afd-aa39-34f81cbedc98"}, {"timestamp": "2025-07-12T00:00:00Z", "date_only": false, "value": "2025-07-12T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-07-12)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "4600f3dd-218b-485f-96a5-b7a38f237bd6"}, {"timestamp": "2025-07-13T00:00:00Z", "date_only": false, "value": "2025-07-13T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-07-13)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "35271075-7ebc-4d99-ab35-9d13d487c739"}, {"timestamp": "2025-07-18T15:51:35Z", "date_only": false, "value": "2025-07-18T15:51:35.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/snmaddula/16c7860a6c8f4aff82049b1abdbf662f", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "9e163947-987a-4bbf-a3ad-001655e240d4", "url": "https://gist.github.com/snmaddula/16c7860a6c8f4aff82049b1abdbf662f"}, {"timestamp": "2025-07-20T00:00:00Z", "date_only": false, "value": "2025-07-20T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-07-20)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "60d7820a-129d-4408-97ba-feb8c80c3dff"}, {"timestamp": "2025-08-02T03:00:05Z", "date_only": false, "value": "2025-08-02T03:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/2X-6AWdwekcmM_24a8Co6gPd7Su--giulRASgvOTWAqI1wg", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "31c69286-e2ed-485e-b4be-c7158150b83b"}, {"timestamp": "2025-08-06T00:00:00Z", "date_only": false, "value": "2025-08-06T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-08-06)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "dfec0ef8-12cf-4f2d-9ad8-5c45e8b95121"}, {"timestamp": "2025-08-06T15:00:07Z", "date_only": false, "value": "2025-08-06T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ihOkiwe6OhHQI2TZ1X3ddAGzem4yCBX0q_BNzRmX2HDnWoU", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "d153a688-096d-4063-ad7d-c25b0d52438c"}, {"timestamp": "2025-08-18T00:00:00Z", "date_only": false, "value": "2025-08-18T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-08-18)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "a7ccbcd4-074c-4222-9bca-0acd77dcde6e"}, {"timestamp": "2025-08-31T03:00:58Z", "date_only": false, "value": "2025-08-31T03:00:58.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "041d1798-059e-4d72-aed0-f08678280f84"}, {"timestamp": "2025-08-31T03:12:43Z", "date_only": false, "value": "2025-08-31T03:12:43.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "ca0d54f7-89de-4f1a-9eab-505d532bccf6"}, {"timestamp": "2025-09-01T00:00:00Z", "date_only": false, "value": "2025-09-01T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-09-01)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "d1b5b146-6a7f-4536-81eb-fc5c97cae1f0"}, {"timestamp": "2025-09-02T00:00:00Z", "date_only": false, "value": "2025-09-02T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-09-02)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "7926b63d-d2c4-41e3-b2e9-0d221330f6b3"}, {"timestamp": "2025-09-04T00:00:00Z", "date_only": true, "value": "2025-09-04", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0756", "record": "CERTFR-2025-AVI-0756", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2025-09-05T00:00:00Z", "date_only": false, "value": "2025-09-05T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2025-AVI-0756", "record": "CERTFR-2025-AVI-0756", "field": "revisions.0.revision_date"}, {"timestamp": "2025-09-13T00:00:00Z", "date_only": false, "value": "2025-09-13T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-09-13)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "714a3327-6a9d-490b-be9a-203585c7816b"}, {"timestamp": "2025-09-14T00:00:00Z", "date_only": false, "value": "2025-09-14T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-09-14)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "fb8c7bc3-2328-4398-b44b-8d62c842eec4"}, {"timestamp": "2025-09-18T00:00:00Z", "date_only": false, "value": "2025-09-18T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-09-18)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "81f2ca8c-4a1e-43cd-b07e-1dda22a90825"}, {"timestamp": "2025-10-04T00:00:00Z", "date_only": false, "value": "2025-10-04T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-10-04)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "fb8f32df-50b2-4008-b088-26afcfd70448"}, {"timestamp": "2025-10-13T09:00:05Z", "date_only": false, "value": "2025-10-13T09:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/WYCMWoQh2a8amWFDZuRYNc5-yqtRSMnumOB0fqqFRkWeIok", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "bd4c3453-4608-4446-a0fa-0a766def4fde"}, {"timestamp": "2025-10-19T10:22:14Z", "date_only": false, "value": "2025-10-19T10:22:14.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/56090", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "1202a493-a665-4351-a62e-4966e5944d05", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aProof-of-Concept (POC) of a simple firewall in Python designed to mitigate the Spring4Shell (CVE-2022-22965) RCE attack by inspecting and blocking malicious request bodies.\nURL\uff1ahttps://github.com/NickoPS87/Spring4Shell-Python-Firewall-POC\n\n\u6807\u7b7e\uff1a#RCE", "url": "https://t.me/GithubRedTeam/56090"}, {"timestamp": "2025-10-19T15:00:07Z", "date_only": false, "value": "2025-10-19T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/7-7SqtMFm30y0jLp6y5GamPMKqVSRatpdn_1oTPkVR9xVFo", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "ca0e19f0-2fdf-4611-b567-8654276c227b"}, {"timestamp": "2025-10-21T23:15:42.792Z", "date_only": false, "value": "2025-10-21T23:15:42.792Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2022-22965", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-10-21T23:15:42.792Z", "date_only": false, "value": "2025-10-21T23:15:42.792Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2022-22965", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-22T19:18:34Z", "date_only": false, "value": "2025-10-22T19:18:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-36P3-WJMG-H94X", "record": "GHSA-36P3-WJMG-H94X", "field": "modified"}, {"timestamp": "2025-11-08T00:00:00Z", "date_only": false, "value": "2025-11-08T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-08)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "34b0a8ad-f414-44ea-a4b0-70c48eff0467"}, {"timestamp": "2025-11-14T15:00:07Z", "date_only": false, "value": "2025-11-14T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/JTPMSiIeITdIAco4zqe7AJCP4y0ey6zBic2rAw1xqSNEfqQ", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "02183cd6-5167-417d-b9ff-7edd2b7639fd"}, {"timestamp": "2025-11-20T23:13:17Z", "date_only": false, "value": "2025-11-20T23:13:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/60328", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "cc25c822-7d96-4d72-8197-1ba63a80bb8d", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aFully automated Spring4Shell (CVE-2022-22965) + GitLab RCE framework\nURL\uff1ahttps://github.com/mylo-2001/GhostStrike\n\n\u6807\u7b7e\uff1a#RCE", "url": "https://t.me/GithubRedTeam/60328"}, {"timestamp": "2025-11-21T03:00:06Z", "date_only": false, "value": "2025-11-21T03:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/tKAkyByJyf-3fTR3FIdOGi_BkQgInDQD9nvMF722k6zIU-s", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "39563bc0-e2aa-4d89-b2d5-cf4303f7dd74"}, {"timestamp": "2025-11-27T00:00:00Z", "date_only": false, "value": "2025-11-27T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-27)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "7ed8c989-304a-4e00-8fab-0d8614a54fb3"}, {"timestamp": "2025-11-28T00:00:00Z", "date_only": false, "value": "2025-11-28T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-28)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "d43e49d5-46cc-4764-a57d-85416931bb64"}, {"timestamp": "2025-12-09T00:00:00Z", "date_only": false, "value": "2025-12-09T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-09)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "32dbc0ce-7ea3-4a4e-af96-f17df1584ac0"}, {"timestamp": "2025-12-10T00:00:00Z", "date_only": false, "value": "2025-12-10T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-10)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "68c8f893-3d9a-4f68-a125-5a8a9bfb6b28"}, {"timestamp": "2025-12-11T00:00:00Z", "date_only": false, "value": "2025-12-11T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-12-11)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "f4996dc3-5003-483d-9c09-4e173766c437"}, {"timestamp": "2025-12-23T21:00:05Z", "date_only": false, "value": "2025-12-23T21:00:05.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/4QOnyeYC_lTC0SMJQhtMgvSiM85xnm7m1QqUSxY6BArIyUs", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "f4216d83-7872-4b47-a4e9-bec2bee8ce1f"}, {"timestamp": "2025-12-25T00:00:00Z", "date_only": false, "value": "2025-12-25T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-12-25)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "2f36b1f2-2262-48d7-8a1a-6b260d3cc2a5"}, {"timestamp": "2026-01-11T00:00:00Z", "date_only": false, "value": "2026-01-11T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-11)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "4c65ab47-dc37-4d53-a45e-0cbb521808dd"}, {"timestamp": "2026-01-11T00:00:00Z", "date_only": false, "value": "2026-01-11T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-01-11)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "3c42874a-e5dc-4bdf-be4d-64359be76143"}, {"timestamp": "2026-01-20T05:01:21Z", "date_only": false, "value": "2026-01-20T05:01:21Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2022-22965", "record": "UBUNTU-CVE-2022-22965", "field": "modified"}, {"timestamp": "2026-01-21T00:00:00Z", "date_only": false, "value": "2026-01-21T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-21)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "2a24e752-7122-4487-ad48-af47a7eaf897"}, {"timestamp": "2026-01-25T23:00:00Z", "date_only": false, "value": "2026-01-25T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.revision_history.26.date"}, {"timestamp": "2026-01-25T23:00:00Z", "date_only": false, "value": "2026-01-25T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-01-26T09:21:26.964Z", "date_only": false, "value": "2026-01-26T09:21:26.964+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-0169", "record": "WID-SEC-W-2022-0169", "field": "document.tracking.generator.date"}, {"timestamp": "2026-01-30T19:25:35Z", "date_only": false, "value": "2026-01-30T19:25:35.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/aw-junaid/ed30afd1f8d04325e68a70aa2e002932", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "6748d9f7-49b6-4c68-904f-009e180980c8", "url": "https://gist.github.com/aw-junaid/ed30afd1f8d04325e68a70aa2e002932"}, {"timestamp": "2026-02-02T12:25:39Z", "date_only": false, "value": "2026-02-02T12:25:39+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2022-22965", "field": "timestamps.recorded_at", "uuid": "c7e9e0be-415b-432d-87ef-47f41a518a9d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-02-02T12:27:53.738Z", "date_only": false, "value": "2026-02-02T12:27:53.738489Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c7e9e0be-415b-432d-87ef-47f41a518a9d", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "c9b3355c-f604-46eb-a629-dd3782f07ee6", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c7e9e0be-415b-432d-87ef-47f41a518a9d"}, {"timestamp": "2026-02-06T00:00:00Z", "date_only": false, "value": "2026-02-06T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-06)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "01c69003-c2ff-4b41-ad0e-bd9828799bd9"}, {"timestamp": "2026-02-09T00:00:00Z", "date_only": false, "value": "2026-02-09T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-09)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "c57d62f3-a4f6-4c2e-9ac8-caab8495201f"}, {"timestamp": "2026-02-12T00:00:00Z", "date_only": false, "value": "2026-02-12T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-12)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "2ee6bae5-c849-418c-847e-a3cfb3a02816"}, {"timestamp": "2026-02-13T10:12:10Z", "date_only": false, "value": "2026-02-13T10:12:10.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/jonathan-gruber-1/05724c8f2229fceca85cb5694e67abbd", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "39aa231c-54be-4550-8305-d8fb3c7fa15e", "url": "https://gist.github.com/jonathan-gruber-1/05724c8f2229fceca85cb5694e67abbd"}, {"timestamp": "2026-02-17T00:00:00Z", "date_only": false, "value": "2026-02-17T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-17)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "789db4ef-9b21-4b41-9c9e-72a5e2e96657"}, {"timestamp": "2026-02-18T00:00:00Z", "date_only": false, "value": "2026-02-18T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-18)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "302c2a45-84df-44e2-a301-f80a18283e65"}, {"timestamp": "2026-02-19T10:22:02.343Z", "date_only": false, "value": "2026-02-19T10:22:02.343067Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvedatabase.bsky.social/post/3mf7eqhtjsh2b", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "87630470-645b-4b9f-8b5c-7587758bd8a3", "url": "https://bsky.app/profile/cvedatabase.bsky.social/post/3mf7eqhtjsh2b"}, {"timestamp": "2026-03-01T00:00:00Z", "date_only": false, "value": "2026-03-01T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-01)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "39459e0f-7fda-4b3d-9aaa-68a31fae76d7"}, {"timestamp": "2026-03-21T00:00:00Z", "date_only": false, "value": "2026-03-21T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-21)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "253c9d5d-f1f4-41e5-bde4-918c506d9a3e"}, {"timestamp": "2026-03-27T00:00:00Z", "date_only": false, "value": "2026-03-27T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-27)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "5d890bce-5d69-4b5b-b918-4e125175eaab"}, {"timestamp": "2026-03-27T17:44:57Z", "date_only": false, "value": "2026-03-27T17:44:57.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/magdielpicpay/5bf3ac09f642892655a1aa250b7108aa", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "1d7ac5d3-ff91-45b5-850c-26982730a082", "url": "https://gist.github.com/magdielpicpay/5bf3ac09f642892655a1aa250b7108aa"}, {"timestamp": "2026-03-31T00:00:00Z", "date_only": false, "value": "2026-03-31T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-31)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "bfbe8019-858c-437d-948c-6bc8a05e892c"}, {"timestamp": "2026-04-01T00:00:00Z", "date_only": false, "value": "2026-04-01T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-04-01)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "24b282a2-8228-49d3-a1ae-2e1d75f2094f"}, {"timestamp": "2026-04-02T00:00:00Z", "date_only": false, "value": "2026-04-02T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-02)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "fb2accc3-0bf3-4e48-b0e1-7931436f45af"}, {"timestamp": "2026-04-03T00:00:00Z", "date_only": false, "value": "2026-04-03T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-03)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "a27fb9a9-87f4-4f62-ab22-83eccf9d3419"}, {"timestamp": "2026-04-10T00:00:00Z", "date_only": false, "value": "2026-04-10T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-04-10)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "5141148f-37cb-4d0c-a979-49dc118661df"}, {"timestamp": "2026-04-10T00:00:00Z", "date_only": false, "value": "2026-04-10T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-10)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "fc684c0a-bdee-4ab0-8ddd-960b69082e07"}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-04-20)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "9b54c206-a77c-475c-8d83-3930a9901aa1"}, {"timestamp": "2026-04-20T00:00:00Z", "date_only": false, "value": "2026-04-20T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-20)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "3bc72d6a-858e-41a3-b32e-40721a162b53"}, {"timestamp": "2026-04-25T00:00:00Z", "date_only": false, "value": "2026-04-25T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-04-25)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "61442efe-f83d-4732-a6fa-83812ea8c938"}, {"timestamp": "2026-04-28T00:00:00Z", "date_only": false, "value": "2026-04-28T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-28)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "fca51ed9-cde3-4646-8f69-a799577f81bc"}, {"timestamp": "2026-05-02T00:00:00Z", "date_only": false, "value": "2026-05-02T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-05-02)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "e866f3a5-e97a-4356-b9cc-a77b6fb5dec9"}, {"timestamp": "2026-05-20T08:01:33Z", "date_only": false, "value": "2026-05-20T08:01:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/84944", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "a49640d5-18ee-4460-8631-ef44d8a2bff1", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Spring4Shell #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2022-22965-Spring4Shell-Security-Operations-Analysis\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Shakur1314\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-03-04 11:06:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA comprehensive Security Operations Centre (SOC) incident response simulation demonstrating threat detection, triage, analysis, and mitigation of the Spring4Shell vulnerability (CVE-2022-22965).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/84944"}, {"timestamp": "2026-05-22T01:06:07Z", "date_only": false, "value": "2026-05-22T01:06:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/85309", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "eedd3bbb-c656-4eaf-95e6-be1edd2cbe1f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Spring4Shell #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Sandbox-Challenge-Spring4Shell-CVE-2022-22965-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a felisha-elmer\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-22 00:29:10\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/85309"}, {"timestamp": "2026-05-27T10:00:36Z", "date_only": false, "value": "2026-05-27T10:00:36.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/86092", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "c5c3d7b6-c382-4068-ba72-e4f2b9493d9a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Spring4Shell #CVE #\u6f0f\u6d1e\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Spring4Shell-CTF\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a YUTING-HUANG0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-27 09:50:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSpring4Shell (CVE-2022-22965) \u6f0f\u6d1e\u74b0\u5883\u642d\u5efa\u8207 CTF \u984c\u76ee\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/86092"}, {"timestamp": "2026-05-27T13:03:44Z", "date_only": false, "value": "2026-05-27T13:03:44.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/86118", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "c26ddba1-dfdc-4a94-ae9d-07d9defac01b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Spring4Shell #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a PoC-CVE-2022-22965-Spring4Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a march0n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-27 12:37:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDescription\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/86118"}, {"timestamp": "2026-05-27T21:02:47Z", "date_only": false, "value": "2026-05-27T21:02:47.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/ymQhnDFcziGLHK8SJX7axBvcDuNVbRkzysaenktlRf2qI3g", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "37a1e41c-fedc-498c-ae7b-ef0d85952f51"}, {"timestamp": "2026-05-31T00:00:00Z", "date_only": false, "value": "2026-05-31T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-05-31)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "5e10e54e-a31b-4b59-8588-fc28a60c1e07"}, {"timestamp": "2026-06-13T00:00:00Z", "date_only": false, "value": "2026-06-13T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-13)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "214654c5-2a52-4a4e-899f-c570a7f95c71"}, {"timestamp": "2026-06-16T22:00:00Z", "date_only": false, "value": "2026-06-16T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-06-16T22:00:00Z", "date_only": false, "value": "2026-06-16T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-06-16T22:00:00Z", "date_only": false, "value": "2026-06-16T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-06-17T04:29:15.610Z", "date_only": false, "value": "2026-06-17T04:29:15.610", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-22965", "record": "FKIE_CVE-2022-22965", "field": "lastModified"}, {"timestamp": "2026-06-17T22:00:00Z", "date_only": false, "value": "2026-06-17T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-06-18T22:00:00Z", "date_only": false, "value": "2026-06-18T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-06-19T12:47:19.815Z", "date_only": false, "value": "2026-06-19T12:47:19.815393Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cd40280b-c564-4d0a-a025-be95859c28c9", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "06fa0062-df04-44e0-a0d7-fa5bbafe6fc7", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cd40280b-c564-4d0a-a025-be95859c28c9"}, {"timestamp": "2026-06-22T00:00:00Z", "date_only": false, "value": "2026-06-22T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-22)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "774644b5-06b7-4112-85ee-f5a74abd8026"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2022-22965", "field": "timestamps.recorded_at", "uuid": "469517cb-a93b-49b4-a3ba-a983b4db382a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:05:17.311Z", "date_only": false, "value": "2026-06-23T14:05:17.311028Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/469517cb-a93b-49b4-a3ba-a983b4db382a", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "1e2ff845-3979-4f15-9842-85bd221c56e5", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/469517cb-a93b-49b4-a3ba-a983b4db382a"}, {"timestamp": "2026-06-24T22:00:00Z", "date_only": false, "value": "2026-06-24T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-06-25T22:00:00Z", "date_only": false, "value": "2026-06-25T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2026-06-28T22:00:00Z", "date_only": false, "value": "2026-06-28T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2026-06-29T22:00:00Z", "date_only": false, "value": "2026-06-29T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.6.date"}, {"timestamp": "2026-06-30T09:22:57.022Z", "date_only": false, "value": "2026-06-30T09:22:57.022971Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6b19bd2d-6d06-4430-8ce2-55e417011a01", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "8fe9bab0-aa68-4012-8da1-a3f6a27bfa8e", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6b19bd2d-6d06-4430-8ce2-55e417011a01"}, {"timestamp": "2026-07-01T22:00:00Z", "date_only": false, "value": "2026-07-01T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.7.date"}, {"timestamp": "2026-07-08T22:00:00Z", "date_only": false, "value": "2026-07-08T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.8.date"}, {"timestamp": "2026-07-11T10:15:13.003Z", "date_only": false, "value": "2026-07-11T10:15:13.003234Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-10)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "fe49243b-4757-418f-a799-84cdfb3b832d"}, {"timestamp": "2026-07-13T10:15:30.461Z", "date_only": false, "value": "2026-07-13T10:15:30.461533Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-12)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "cd499831-8190-4f6f-802f-73f5a59b124f"}, {"timestamp": "2026-07-13T22:00:16.299Z", "date_only": false, "value": "2026-07-13T22:00:16.299503Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/91279", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "d738c39b-bc0f-40f8-8666-751270e8bba8", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Spring4Shell #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2022-22965-Spring4Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Kuri119\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 11:23:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/91279"}, {"timestamp": "2026-07-13T22:00:22.322Z", "date_only": false, "value": "2026-07-13T22:00:22.322737Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/89888", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "8317f02f-0687-46dd-be1a-6b694f752482", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Spring4Shell #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a jfrog-apptrust-demo\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ernestom-commits\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-21 03:02:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nJFrog AppTrust lifecycle policy enforcement demo \u2014 shows release gate blocking CVE-2022-22965 (Spring4Shell) with waiver request flow\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/89888"}, {"timestamp": "2026-07-15T00:00:18.356Z", "date_only": false, "value": "2026-07-15T00:00:18.356681Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/89888", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "0ccd60c8-39d8-451f-b741-824460caa0bd", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Spring4Shell #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a jfrog-apptrust-demo\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ernestom-commits\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-21 03:02:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nJFrog AppTrust lifecycle policy enforcement demo \u2014 shows release gate blocking CVE-2022-22965 (Spring4Shell) with waiver request flow\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/89888"}, {"timestamp": "2026-07-15T00:00:25.500Z", "date_only": false, "value": "2026-07-15T00:00:25.500742Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/91279", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "f05de520-65ca-4d57-8f2f-1bb1909ac9b8", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Spring4Shell #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2022-22965-Spring4Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Kuri119\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 11:23:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/91279"}, {"timestamp": "2026-07-15T22:00:00Z", "date_only": false, "value": "2026-07-15T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.9.date"}, {"timestamp": "2026-07-16T12:00:06.060Z", "date_only": false, "value": "2026-07-16T12:00:06.060886Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/93494", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "067fc129-d681-489f-9389-de6b6650956c", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Spring4Shell #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a spring4shell-local-verification-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a meng-security\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-15 07:43:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSpring Framework CVE-2022-22965 \u672c\u5730\u5f71\u54cd\u6761\u4ef6\u9a8c\u8bc1\u3001\u7248\u672c\u5347\u7ea7\u4fee\u590d\u4e0e\u590d\u6d4b\u9879\u76ee\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93494"}, {"timestamp": "2026-07-16T12:15:03.550Z", "date_only": false, "value": "2026-07-16T12:15:03.550604Z", "kind": "sighting", "label": "Seen", "source": "MISP/c6bff539-f10a-42a7-bc8e-83795d457e7a", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "66cef812-71b7-43d3-b6a8-bfa690d02c2a"}, {"timestamp": "2026-07-16T19:00:18.240Z", "date_only": false, "value": "2026-07-16T19:00:18.240308Z", "kind": "sighting", "label": "Seen", "source": "Telegram/MYczrieigu1A3MhWknQzdl_ZFhSKZitH7RdEW45J-iqySiE", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "116a600f-d90c-4ce9-94b6-32128f5e604e"}, {"timestamp": "2026-07-17T00:00:53.531Z", "date_only": false, "value": "2026-07-17T00:00:53.531511Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93494", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "7abc9023-f250-48db-a1c9-aa7e2323b69e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Spring4Shell #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a spring4shell-local-verification-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a meng-security\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-15 07:43:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSpring Framework CVE-2022-22965 \u672c\u5730\u5f71\u54cd\u6761\u4ef6\u9a8c\u8bc1\u3001\u7248\u672c\u5347\u7ea7\u4fee\u590d\u4e0e\u590d\u6d4b\u9879\u76ee\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93494"}, {"timestamp": "2026-07-17T05:00:06.631Z", "date_only": false, "value": "2026-07-17T05:00:06.631348Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/EchelonEyes/144", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "fb8a07af-9061-4d75-917b-ba781514333d", "content": "\u041c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0439 Spring Framework \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043a Spring4Shell\n\n\u0420\u0430\u043d\u0435\u0435 \u043c\u044b \u043f\u0438\u0441\u0430\u043b\u0438  \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u00ab\u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f\u00bb \u0432\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Spring Framework - CVE-2022-22965, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Spring4Shell. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0441\u0447\u0438\u0442\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e 6000 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043e\u0434\u043d\u0430\u043a\u043e \u0431\u043e\u043b\u0435\u0435 \u043d\u043e\u0432\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043d\u0430\u043c\u043d\u043e\u0433\u043e \u0431\u043e\u043b\u044c\u0448\u0435.\n\n\u0412 \u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a \u0440\u044f\u0434 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u043a\u0430\u0437\u0430\u043b \u043d\u0430 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0439 Spring Framework, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Java \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443\u044e\u0442 \u043e \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430\u0445. \n\n\u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0414\u0436\u0430\u0440\u0435\u0434\u0430 \u0421\u043c\u0438\u0442\u0430, \u0441\u0442\u0430\u0440\u0448\u0435\u0433\u043e \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0430 \u043f\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u0443\u0433\u0440\u043e\u0437 \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SecurityScorecard, \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u0438 \u0443\u0437\u043b\u043e\u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u043e 150 000 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u0434\u043e 600 000 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043c\u043e\u0433\u0443\u0442 \u0438\u043c\u0435\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0421\u043c\u0438\u0442\u0430, \u0441\u0435\u0440\u0432\u0435\u0440\u044b SecurityScorecard \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0434\u0430\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u043d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\n\u0412 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0434\u0440\u0443\u0433\u0430\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, Sonatype \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u00ab\u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00bb, \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u0432 \u0432 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0438\u0445 \u0441\u043b\u043e\u0432 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u044b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u043f\u0430\u043d\u0435\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442: \u0434\u043e\u043b\u0436\u043d\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c\u0441\u044f \u0432\u0435\u0441\u044c\u043c\u0430 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430, \u0447\u0442\u043e\u0431\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u0432 \u0437\u043e\u043d\u0435 \u0440\u0438\u0441\u043a\u0430. \u0422\u0435\u043a\u0443\u0449\u0438\u0439 \u043a\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f Spring \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u0438\u043c \u043e\u0431\u044a\u044f\u0441\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: \nhttps://www.darkreading.com/application-security/vulnerable-spring-framework-instances-estimated-at-possibly-millions \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #SpringFramework #Spring4Shell", "url": "https://t.me/EchelonEyes/144"}, {"timestamp": "2026-07-18T00:00:25.139Z", "date_only": false, "value": "2026-07-18T00:00:25.139237Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/MYczrieigu1A3MhWknQzdl_ZFhSKZitH7RdEW45J-iqySiE", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "bdbb770f-eeb1-4cce-8a3e-00bd9995ca76"}, {"timestamp": "2026-07-18T00:00:36Z", "date_only": false, "value": "2026-07-18T00:00:36.000031Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/EchelonEyes/144", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "a1746020-a4f7-4bb4-91a2-e37f9b711dcc", "content": "\u041c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0439 Spring Framework \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043a Spring4Shell\n\n\u0420\u0430\u043d\u0435\u0435 \u043c\u044b \u043f\u0438\u0441\u0430\u043b\u0438  \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u00ab\u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f\u00bb \u0432\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Spring Framework - CVE-2022-22965, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Spring4Shell. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0441\u0447\u0438\u0442\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u043a\u043e\u043b\u043e 6000 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u043e\u0434\u043d\u0430\u043a\u043e \u0431\u043e\u043b\u0435\u0435 \u043d\u043e\u0432\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043d\u0430\u043c\u043d\u043e\u0433\u043e \u0431\u043e\u043b\u044c\u0448\u0435.\n\n\u0412 \u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a \u0440\u044f\u0434 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u043a\u0430\u0437\u0430\u043b \u043d\u0430 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0439 Spring Framework, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Java \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443\u044e\u0442 \u043e \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430\u0445. \n\n\u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0414\u0436\u0430\u0440\u0435\u0434\u0430 \u0421\u043c\u0438\u0442\u0430, \u0441\u0442\u0430\u0440\u0448\u0435\u0433\u043e \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0430 \u043f\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u0443\u0433\u0440\u043e\u0437 \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SecurityScorecard, \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u0438 \u0443\u0437\u043b\u043e\u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u0432\u044b\u044f\u0432\u0438\u043b\u043e 150 000 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u0434\u043e 600 000 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043c\u043e\u0433\u0443\u0442 \u0438\u043c\u0435\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0421\u043c\u0438\u0442\u0430, \u0441\u0435\u0440\u0432\u0435\u0440\u044b SecurityScorecard \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0434\u0430\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u043d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\n\u0412 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0434\u0440\u0443\u0433\u0430\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, Sonatype \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u00ab\u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00bb, \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u0432 \u0432 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0438\u0445 \u0441\u043b\u043e\u0432 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u044b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u043f\u0430\u043d\u0435\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442: \u0434\u043e\u043b\u0436\u043d\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c\u0441\u044f \u0432\u0435\u0441\u044c\u043c\u0430 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430, \u0447\u0442\u043e\u0431\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u0432 \u0437\u043e\u043d\u0435 \u0440\u0438\u0441\u043a\u0430. \u0422\u0435\u043a\u0443\u0449\u0438\u0439 \u043a\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f Spring \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u0438\u043c \u043e\u0431\u044a\u044f\u0441\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: \nhttps://www.darkreading.com/application-security/vulnerable-spring-framework-instances-estimated-at-possibly-millions \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #SpringFramework #Spring4Shell", "url": "https://t.me/EchelonEyes/144"}, {"timestamp": "2026-07-18T18:00:04.285Z", "date_only": false, "value": "2026-07-18T18:00:04.285139Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/159", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "57c19fed-cff8-498c-9dd6-1efc620c5e00", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-22965\nGithub: https://github.com/sunnyvale-it/CVE-2022-22965-PoC\nDescribe: \nA Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.", "url": "https://t.me/CVEhub/159"}, {"timestamp": "2026-07-19T22:00:00Z", "date_only": false, "value": "2026-07-19T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.10.date"}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": false, "value": "2026-07-20T00:00:00+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2022-22965", "field": "timestamps.last_seen_at", "uuid": "6b19bd2d-6d06-4430-8ce2-55e417011a01", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": true, "value": "2026-07-20", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2022-22965", "field": "evidence.0.details.observation_date", "uuid": "6b19bd2d-6d06-4430-8ce2-55e417011a01", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": false, "value": "2026-07-20T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2022-22965", "field": "status.status_updated_at", "uuid": "6b19bd2d-6d06-4430-8ce2-55e417011a01", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-20T22:00:00Z", "date_only": false, "value": "2026-07-20T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.11.date"}, {"timestamp": "2026-07-21T22:00:00Z", "date_only": false, "value": "2026-07-21T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.12.date"}, {"timestamp": "2026-07-22T01:00:01Z", "date_only": false, "value": "2026-07-22T01:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2022-22965", "field": "timestamps.recorded_at", "uuid": "6b19bd2d-6d06-4430-8ce2-55e417011a01", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-23T10:15:09.874Z", "date_only": false, "value": "2026-07-23T10:15:09.874437Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-22)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "58b9ad2a-ac2f-4a79-8f4b-4b59da9c3a67"}, {"timestamp": "2026-07-23T18:15:03.303Z", "date_only": false, "value": "2026-07-23T18:15:03.303191Z", "kind": "sighting", "label": "Seen", "source": "MISP/be71b4bd-4071-4e17-bb48-01ca64164811", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "ed554222-7ed8-463e-81ca-cea2bfa8beb8"}, {"timestamp": "2026-07-24T00:15:03.977Z", "date_only": false, "value": "2026-07-24T00:15:03.977571Z", "kind": "sighting", "label": "Seen", "source": "MISP/be71b4bd-4071-4e17-bb48-01ca64164811", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "260e5cc2-a863-4f98-a485-2aa05256b965"}, {"timestamp": "2026-07-24T10:15:11.346Z", "date_only": false, "value": "2026-07-24T10:15:11.346234Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-23)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "ff37f3c0-71cd-4629-a528-2588f66ef408"}, {"timestamp": "2026-07-25T10:15:18.681Z", "date_only": false, "value": "2026-07-25T10:15:18.681681Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-24)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "7b5ec61d-6dd6-40d4-a1a7-eb22495a68f3"}, {"timestamp": "2026-07-27T22:00:00Z", "date_only": false, "value": "2026-07-27T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.13.date"}, {"timestamp": "2026-07-28T22:00:00Z", "date_only": false, "value": "2026-07-28T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.14.date"}, {"timestamp": "2026-07-29T12:00:26.568Z", "date_only": false, "value": "2026-07-29T12:00:26.568349Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CVEhub/14282", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "4d61067f-3016-4aab-99d9-cbc5057b48b0", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-22965*\nGithub: https://github.com/BKLockly/CVE-2022-22965", "url": "https://t.me/CVEhub/14282"}, {"timestamp": "2026-07-29T12:00:35.328Z", "date_only": false, "value": "2026-07-29T12:00:35.328313Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CVEhub/11711", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "0ee673af-9a59-4e79-992c-f876750e81b7", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-22965-PoC*\nGithub: https://github.com/sunnyvale-it/CVE-2022-22965-PoC", "url": "https://t.me/CVEhub/11711"}, {"timestamp": "2026-07-29T12:00:52.102Z", "date_only": false, "value": "2026-07-29T12:00:52.102785Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CVEhub/6602", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "af617e2f-d8c4-4d0b-888b-e3f63f69986c", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2022-22965*\nGithub: https://github.com/pwnwriter/CVE-2022-22965", "url": "https://t.me/CVEhub/6602"}, {"timestamp": "2026-07-29T12:02:42.517Z", "date_only": false, "value": "2026-07-29T12:02:42.517104Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/2305", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "48924df1-7022-4ece-a563-08f217cf532d", "content": "CVE-2022-22965: Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware https://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html", "url": "https://t.me/reverseame/2305"}, {"timestamp": "2026-07-29T12:02:43.135Z", "date_only": false, "value": "2026-07-29T12:02:43.135202Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/2263", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "4d0fbe49-8c38-4754-9c66-0481f3df6321", "content": "SpringShell (Spring4Shell) Zero-Day Vulnerability CVE-2022-22965 : All You Need To Know https://jfrog.com/blog/springshell-zero-day-vulnerability-all-you-need-to-know/", "url": "https://t.me/reverseame/2263"}, {"timestamp": "2026-07-29T12:02:43.188Z", "date_only": false, "value": "2026-07-29T12:02:43.188774Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/2269", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "7b2d4880-1738-4d58-a7fa-aea21fa8e803", "content": "Spring4Shell (CVE-2022-22965) FAQ: Spring Framework Remote Code Execution Vulnerability  https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability", "url": "https://t.me/reverseame/2269"}, {"timestamp": "2026-07-29T12:02:43.233Z", "date_only": false, "value": "2026-07-29T12:02:43.233271Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/2260", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "8c015cd3-b3ff-4cb4-80cb-fccc34431858", "content": "Spring4Shell: Zero-Day Vulnerability in Spring Framework (CVE-2022-22965) https://www.rapid7.com/blog/post/2022/03/30/spring4shell-zero-day-vulnerability-in-spring-framework/", "url": "https://t.me/reverseame/2260"}, {"timestamp": "2026-07-29T12:03:21.492Z", "date_only": false, "value": "2026-07-29T12:03:21.492806Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/sysadm_in_up/1170", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "b15ef428-48a6-4520-b22e-49f3e0350865", "content": "Detecting Spring4Shell (CVE-2022-22965) with Wazuh\n\nhttps://wazuh.com/blog/detecting-spring4shell-cve-2022-22965-with-wazuh/", "url": "https://t.me/sysadm_in_up/1170"}, {"timestamp": "2026-07-29T22:00:00Z", "date_only": false, "value": "2026-07-29T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.15.date"}, {"timestamp": "2026-07-31T00:00:26.362Z", "date_only": false, "value": "2026-07-31T00:00:26.362677Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/14282", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "10746316-1062-4fab-a56d-242c4253b430", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-22965*\nGithub: https://github.com/BKLockly/CVE-2022-22965", "url": "https://t.me/CVEhub/14282"}, {"timestamp": "2026-07-31T03:00:04.468Z", "date_only": false, "value": "2026-07-31T03:00:04.468582Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/11711", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "2c3b38f0-b16d-442f-94ba-883caef7bfd8", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-22965-PoC*\nGithub: https://github.com/sunnyvale-it/CVE-2022-22965-PoC", "url": "https://t.me/CVEhub/11711"}, {"timestamp": "2026-07-31T18:00:04.305Z", "date_only": false, "value": "2026-07-31T18:00:04.305428Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/6602", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "0047c941-8a60-4c68-928a-2c042daacca8", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2022-22965*\nGithub: https://github.com/pwnwriter/CVE-2022-22965", "url": "https://t.me/CVEhub/6602"}, {"timestamp": "2026-08-02T11:12:27.409Z", "date_only": false, "value": "2026-08-02T11:12:27.409900Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-01)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "b68d8cba-4739-4f89-af02-746ce3af20a8"}, {"timestamp": "2026-08-02T11:17:30.311Z", "date_only": false, "value": "2026-08-02T11:17:30.311982Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-01)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "1d5977ca-5163-491b-80b0-f6b18a396d04"}, {"timestamp": "2026-08-02T22:00:00Z", "date_only": false, "value": "2026-08-02T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.revision_history.16.date"}, {"timestamp": "2026-08-02T22:00:00Z", "date_only": false, "value": "2026-08-02T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-08-03T00:02:19.867Z", "date_only": false, "value": "2026-08-03T00:02:19.867852Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/reverseame/2305", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "a1456016-b62a-448b-8eaf-60e38eb3910e", "content": "CVE-2022-22965: Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing and Executing the Mirai Botnet Malware https://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html", "url": "https://t.me/reverseame/2305"}, {"timestamp": "2026-08-03T01:08:44.382Z", "date_only": false, "value": "2026-08-03T01:08:44.382623Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/reverseame/2260", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "d2028739-6433-4bfa-9086-8afd7be356d0", "content": "Spring4Shell: Zero-Day Vulnerability in Spring Framework (CVE-2022-22965) https://www.rapid7.com/blog/post/2022/03/30/spring4shell-zero-day-vulnerability-in-spring-framework/", "url": "https://t.me/reverseame/2260"}, {"timestamp": "2026-08-03T01:08:44.519Z", "date_only": false, "value": "2026-08-03T01:08:44.519214Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/reverseame/2263", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "12030bc4-ef94-44a5-97e2-e8542da3ac3e", "content": "SpringShell (Spring4Shell) Zero-Day Vulnerability CVE-2022-22965 : All You Need To Know https://jfrog.com/blog/springshell-zero-day-vulnerability-all-you-need-to-know/", "url": "https://t.me/reverseame/2263"}, {"timestamp": "2026-08-03T07:17:55.294Z", "date_only": false, "value": "2026-08-03T07:17:55.294+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1955", "record": "WID-SEC-W-2026-1955", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-03T18:00:05.257Z", "date_only": false, "value": "2026-08-03T18:00:05.257308Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/96473", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "db35888a-ec64-4e47-ac1b-650a2c09176c", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Spring4Shell #CVE #RCE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Spring4Shell-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a PrinceH4k\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-03 16:30:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nProof of Concept for exploiting the CVE-2022-22965 (Spring4Shell) vulnerability in an isolated environment, with Remote Code Execution (RCE) demonstrated.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/96473"}, {"timestamp": "2026-08-03T22:00:04.769Z", "date_only": false, "value": "2026-08-03T22:00:04.769350Z", "kind": "sighting", "label": "Seen", "source": "Telegram/8MACsHHBjvH-w2bDE0n4lckqBSM7-2MqijGfC_zfnUjzr_w", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "63a50f17-b656-48a3-b501-9008efb9d713"}, {"timestamp": "2026-08-04T00:00:10.709Z", "date_only": false, "value": "2026-08-04T00:00:10.709222Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/8MACsHHBjvH-w2bDE0n4lckqBSM7-2MqijGfC_zfnUjzr_w", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "e9dba08e-5bcb-42bc-9d28-543529e709ca"}, {"timestamp": "2026-08-04T04:00:03.760Z", "date_only": false, "value": "2026-08-04T04:00:03.760453Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/sysadm_in_up/1170", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "6efe05e3-21fb-4410-81d3-1e02b3aa4989", "content": "Detecting Spring4Shell (CVE-2022-22965) with Wazuh\n\nhttps://wazuh.com/blog/detecting-spring4shell-cve-2022-22965-with-wazuh/", "url": "https://t.me/sysadm_in_up/1170"}, {"timestamp": "2026-08-04T13:00:25.166Z", "date_only": false, "value": "2026-08-04T13:00:25.166753Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/wh_lab/59", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "59d414cb-22b8-4977-9abc-c6df0b52aa12", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\n\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f Whitehat Lab", "url": "https://t.me/wh_lab/59"}, {"timestamp": "2026-08-05T10:00:09.944Z", "date_only": false, "value": "2026-08-05T10:00:09.944980Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-04)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "5ab8d587-ea0c-4c86-927a-d04287862be5"}, {"timestamp": "2026-08-06T00:00:42.349Z", "date_only": false, "value": "2026-08-06T00:00:42.349216Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/wh_lab/59", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "1cb8948b-698a-4ab3-96ac-42aa0542c01b", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\n\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f Whitehat Lab", "url": "https://t.me/wh_lab/59"}, {"timestamp": "2026-08-07T10:45:13.451Z", "date_only": false, "value": "2026-08-07T10:45:13.451202Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-06)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "37aaa478-80c8-49d2-a56d-7fc1d9ce9bba"}, {"timestamp": "2026-08-08T11:05:23.197Z", "date_only": false, "value": "2026-08-08T11:05:23.197830Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-07)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "91330f52-8fc3-4edf-811d-8df30f5107b5"}, {"timestamp": "2026-08-15T08:00:10.613Z", "date_only": false, "value": "2026-08-15T08:00:10.613481Z", "kind": "sighting", "label": "Seen", "source": "Telegram/4566Kl3I9kWhSM5xXDNztOZYG_LcHKWrCL2kjHmuWe0ECr4", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "4f52607c-f4e9-46f5-a217-f1bc04da71a8"}, {"timestamp": "2026-08-16T00:00:12.763Z", "date_only": false, "value": "2026-08-16T00:00:12.763391Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/4566Kl3I9kWhSM5xXDNztOZYG_LcHKWrCL2kjHmuWe0ECr4", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "1fefeb72-5776-47d1-979c-33f2b05bc872"}, {"timestamp": "2026-08-16T10:15:07.381Z", "date_only": false, "value": "2026-08-16T10:15:07.381692Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-15)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "2c7edc28-6942-4d56-b4c0-3d8d225e5729"}, {"timestamp": "2026-08-22T10:15:09.055Z", "date_only": false, "value": "2026-08-22T10:15:09.055863Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-21)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "fd6ffb73-44b2-48f0-95a4-c69487b8ea45"}, {"timestamp": "2026-08-24T10:00:08.643Z", "date_only": false, "value": "2026-08-24T10:00:08.643253Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-23)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "9ee9d673-15c0-45b1-8ede-d4c79d2875a1"}, {"timestamp": "2026-08-24T10:15:34.529Z", "date_only": false, "value": "2026-08-24T10:15:34.529378Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-23)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "a2791a58-a426-4d6a-b2fe-b0f646dffe0d"}, {"timestamp": "2026-08-26T10:15:37.339Z", "date_only": false, "value": "2026-08-26T10:15:37.339835Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-25)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "92178786-adce-46d6-acfb-edbc6e02892d"}, {"timestamp": "2026-08-27T12:00:05.331Z", "date_only": false, "value": "2026-08-27T12:00:05.331616Z", "kind": "sighting", "label": "Seen", "source": "Telegram/ffKlG2fYJe_qUeuQCHj3J9BzzMW_6IY6h6bicEkkzdHSiG8", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "1cde1f20-c336-4adc-a3c5-f3b3dc2b87da"}, {"timestamp": "2026-08-28T00:00:45.562Z", "date_only": false, "value": "2026-08-28T00:00:45.562082Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ffKlG2fYJe_qUeuQCHj3J9BzzMW_6IY6h6bicEkkzdHSiG8", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "474b87ca-917b-4026-9cf7-ae82b24e44ea"}, {"timestamp": "2026-08-30T10:00:08.064Z", "date_only": false, "value": "2026-08-30T10:00:08.064824Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-29)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "bdaffa5b-1d19-427f-b728-4240a7299ea2"}, {"timestamp": "2026-08-30T10:15:09.890Z", "date_only": false, "value": "2026-08-30T10:15:09.890748Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-29)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "0583fe4d-aa0e-4d14-a3d2-bccdcb5257c2"}, {"timestamp": "2026-09-01T17:00:30.070Z", "date_only": false, "value": "2026-09-01T17:00:30.070679Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/5739", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "8cb8dd4c-45e6-4724-85eb-7e077bcec403", "content": "Blue_Team_Techniques\n1. A list of open source web security scanners\nhttps://github.com/psiinon/open-source-web-scanners\n\n2. Script to check for Spring4Shell vulnerability\nhttps://github.com/jrgdiaz/Spring4Shell-CVE-2022-22965.py\n\n3. A fully automated, reliable, and accurate scanner for finding Spring4Shell/Spring Cloud RCE vulnerabilities\nhttps://github.com/fullhunt/spring4shell-scan", "url": "https://t.me/cissp/5739"}, {"timestamp": "2026-09-01T17:00:30.731Z", "date_only": false, "value": "2026-09-01T17:00:30.731082Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/5685", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "8da75cb6-0355-4024-a3da-8d84618ca740", "content": "Important \u2014 Spring Framework maintainers have released an emergency patch to address a newly disclosed RCE vulnerability (CVE-2022-22965) that could allow unauthenticated attackers to take control of targeted systems.\n\nDetails: https://thehackernews.com/2022/03/security-patch-releases-for-critical.html", "url": "https://t.me/cissp/5685"}, {"timestamp": "2026-09-01T20:01:15.202Z", "date_only": false, "value": "2026-09-01T20:01:15.202759Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/79492", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "c4b6189f-ac2f-456a-9c79-04c028dbe41d", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "url": "https://t.me/hacking_Attack/79492"}, {"timestamp": "2026-09-01T20:01:35.590Z", "date_only": false, "value": "2026-09-01T20:01:35.590764Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/58331", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "41d1dcf9-a2d7-41a7-a988-8223dbf2920b", "content": "Kali Linux Tutorials\nSpring4Shell-POC : Dockerized Spring4Shell (CVE-2022-22965) PoC Application And Exploit\n\nSpring4Shell-POC is a dockerized application that is vulnerable to the Spring4Shell vulnerability (CVE-2022-22965). Full Java source for the war is provided and modifiable, the war will get re-built whenever the docker image is built. The built WAR will then be loaded by Tomcat. There is nothing special about this application, it\u2019s a simple hello world that\u2019s based off\u00a0Spring tutorials.\n\nRequirements\n\n* Docker\n* Python3 + requests library\n\nInstructions\n\n* Clone the repository\n* Build and run the container: docker build . -t spring4shell && docker run -p 8080:8080 spring4shell\n* App should now be available at\u00a0http://localhost:8080/helloworld/greeting\n* Run the exploit.py script: python exploit.py --url \"http://localhost:8080/helloworld/greeting\"\n* Visit the created webshell! Modify the cmdGET parameter for your commands. (http://localhost:8080/shell.jsp\u00a0by default)\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/58331"}, {"timestamp": "2026-09-01T20:01:36.796Z", "date_only": false, "value": "2026-09-01T20:01:36.796542Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/56907", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "5bc2b39f-cd0e-49ba-9586-53402a2ca6f5", "content": "Kali Linux Tutorials\nSpring4Shell-Scan : A Fully Automated, Reliable, And Accurate Scanner For Finding Spring4Shell\n\nSpring4Shell-Scan is a fully automated, reliable, and accurate scanner for finding Spring4Shell and Spring Cloud RCE vulnerabilities.\n\nFeatures\n\n* Support for lists of URLs.\n* Fuzzing for more than 10 new Spring4Shell payloads (previously seen tools uses only 1-2 variants).\n* Fuzzing for HTTP GET and POST methods.\n* Automatic validation of the vulnerability upon discovery.\n* Randomized and non-intrusive payloads.\n* WAF Bypass payloads.\n\nDescription\n\nThe Spring4Shell RCE is a critical vulnerability that FullHunt has been researching since it was released. We worked with our customers in scanning their environments for Spring4Shell and Spring Cloud RCE vulnerabilities.\n\nWe\u2019re open-sourcing an open detection scanning tool for discovering Spring4Shell (CVE-2022-22965) and Spring Cloud RCE (CVE-2022-22963) vulnerabilities. This shall be used by security teams to scan their infrastructure, as well as test for WAF bypasses that can result in achieving successful exploitation of the organization\u2019s environment.\n\nIf your organization requires help, please contact (team at fullhunt.io) directly for a full attack surface discovery and scanning for the Spring4Shell vulnerabilities.\n\nUsage\n\n$ ./spring4shell-scan.py -h\n[\u2022] CVE-2022-22965 \u2013 Spring4Shell RCE Scanner\n[\u2022] Scanner provided by FullHunt.io \u2013 The Next-Gen Attack Surface Management Platform.\n[\u2022] Secure your External Attack Surface with FullHunt.io.\nusage: spring4shell-scan.py [-h] [-u URL] [-p PROXY] [-l USEDLIST] [\u2013payloads-file PAYLOADS_FILE] [\u2013waf-bypass] [\u2013request-type REQUEST_TYPE] [\u2013test-CVE-2022-22963]\noptional arguments:\n-h, \u2013help show this help message and exit\n-u URL, \u2013url URL Check a single URL.\n-p PROXY, \u2013proxy PROXY\nSend requests through proxy\n-l USEDLIST, \u2013list USEDLIST\nCheck a list of URLs.\n\u2013payloads-file PAYLOADS_FILE\nPayloads file \u2013 [default: payloads.txt].\n\u2013waf-bypass Extend scans with WAF bypass payloads.\n\u2013request-type REQUEST_TYPE\nRequest Type: (get, post, all) \u2013 [Default: all].\n\u2013test-CVE-2022-22963\nTest for CVE-2022-22963 (Spring Cloud RCE).\n\nScan a Single URL\n\n$ python3 spring4shell-scan.py -u https://spring4shell.lab.secbot.local\n\nDiscover WAF bypasses against the environment\n\n$ python3 spring4shell-scan.py -u https://spring4shell.lab.secbot.local \u2013waf-bypass\n\nScan a list of URLs\n\n$ python3 spring4shell-scan.py -l urls.txt\n\nInclude checks for Spring Cloud RCE (CVE-2022-22963)\n\n$ python3 spring4shell-scan.py -l urls.txt \u2013test-CVE-2022-22963\n\nInstallation\n\n$ pip3 install -r requirements.txt\n\nDocker Support\n\ngit clone https://github.com/fullhunt/spring4shell-scan.git\ncd spring4shell-scan\nsudo docker build -t spring4shell-scan .\nsudo docker run -it \u2013rm spring4shell-scan\nWith URL list \u201curls.txt\u201d in current directory\ndocker run -it \u2013rm -v $PWD:/data spring4shell-scan -l /data/urls.txt\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/56907"}, {"timestamp": "2026-09-01T20:01:41.594Z", "date_only": false, "value": "2026-09-01T20:01:41.594065Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/52890", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "93069066-b1dc-4f4d-b88b-c3383e310d55", "content": "KitPloit - PenTest Tools!\nSpring4Shell-POC - Dockerized Spring4Shell (CVE-2022-22965) PoC Application And Exploit\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjaq3n6pTYJadYNCpjVegHxZFc8ZwiZUtKbPgpxPlbSd7vQgjUEfKFw0cO8jrAjpHsv_tzZAG_chVh9Mwrrh9UpIHbkniKAjKptmjj-rJ2uOjSxvBrPfVn3H2AZpIjCO-1Lrt4HnOxh7SS5SrMbbIttLpUzw7xDtIat1yKhbVk_0JgC8RDhwEXTMEuY/w640-h308/Spring4Shell.png This is a dockerized application that is vulnerable to the Spring4Shell vulnerability (CVE-2022-22965). Full Java source for the war is provided and modifiable, the war will get re-built whenever the docker image is built. The built WAR will then be loaded by Tomcat. There is nothing special about this application, it's a simple hello world that's based off Spring tutorials.\n\nDetails: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities\n\nHaving issues with the POC? Check out the LunaSec fork at: https://github.com/lunasec-io/Spring4Shell-POC, it's more actively maintained. Requirements1. Docker\n2. Python3 + requests library Instructions1. Clone the repository\n2. Build and run the container: docker build . -t spring4shell && docker run -p 8080:8080 spring4shell3. App should now be available at http://localhost:8080/helloworld/greeting https://blogger.googleusercontent.com/img/a/AVvXsEgiSKKOBdAf-H6x6nvFmF2wHQ0WkAKdimGQcO3ortF_UVrOhKDkUDmIr4gxFzpaEaodNjEbpOo2z05EuGygz6K7atd6sXZYvXGfs60tMvLY5ZPxKOwuFrODicy7AbrL7kskqnDMETdZ2FPvJ1mD0gw2LxfG-qch-LSC8tBo7hIW-JM4Jj9jGhkehhhD=w640-h124 1. Run the exploit.py script: python exploit.py --url \"http://localhost:8080/helloworld/greeting\"https://blogger.googleusercontent.com/img/a/AVvXsEhXbcvigqvcJMzQzqHzuPqv8kDD2hEASz5zefNLhrnslPL6PVh8EdqWR0NFrOVdonBf7kBvzydhbiiPpBmFXSQun215RFALW4ijb3ucOIgmJKqELuISNRn59h8q-FHSlsEeoc594Ns_vIAkKrrogsoVbif_ufTU9Udrr2Umykdeyz9b0o3y5DkRXVhj=w640-h50 1. Visit the created webshell! Modify the cmdGET parameter for your commands. (http://localhost:8080/shell.jsp by default) https://blogger.googleusercontent.com/img/a/AVvXsEgTxfQevfT3YeenETl-w22eGNM_pdTzRn-0Nr0fwMbrmE7CLOkf33fpWA0N4zEloY3M1qI7ja7sQ-MziwLKY0FoiMoJ1e1kPhHSTMnyCU8L358ZRZTXcLmZDM7U9FHf7YuvY_3Nu3l17zdYcxQC4C9UgkypJ82wWMrgZt1jZ1cS_-2kOH7GfPdZgu6F=w640-h118 NotesFixed! As of this writing, the container (possibly just Tomcat) must be restarted between exploitations. I'm actively trying to resolve this.\n\nRe-running the exploit will create an extra artifact file of {old_filename}_.jsp.\n\nPRs/DMs @Rezn0k are welcome for improvements! Credits* @esheavyind for help on building a PoC. Check out their writeup at: https://gist.github.com/esell/c9731a7e2c5404af7716a6810dc33e1a\n* @LunaSecIO for improving the documentation and exploit\n* @rwincey for making the exploit replayable without requiring a Tomcat restart Download Spring4Shell-POC\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/52890"}, {"timestamp": "2026-09-01T20:01:41.934Z", "date_only": false, "value": "2026-09-01T20:01:41.934217Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/52874", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "b13a03e0-63bc-44b3-9291-dbfa6d01257a", "content": "Spring4Shell-POC - Dockerized Spring4Shell (CVE-2022-22965) PoC Application And Exploit\nhttp://www.kitploit.com/2022/05/spring4shell-poc-dockerized.html\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/52874"}, {"timestamp": "2026-09-01T20:01:41.979Z", "date_only": false, "value": "2026-09-01T20:01:41.979924Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/52876", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "f14808d7-b1eb-419a-9d79-e9d541ba13ed", "content": "This is a dockerized application that is vulnerable (https://www.kitploit.com/search/label/Vulnerable) to the Spring4Shell vulnerability (https://www.kitploit.com/search/label/Vulnerability) (CVE-2022-22965). Full Java source for the war is provided and modifiable, the war will get re-built whenever the docker image is built. The built WAR will then be loaded by Tomcat. There is nothing special about this application, it's a simple hello world that's based off Spring tutorials (https://spring.io/guides/gs/handling-form-submission/).  Details: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilitiesHaving issues with the POC? Check out the LunaSec fork at: https://github.com/lunasec-io/Spring4Shell-POC, it's more actively maintained.  Requirements    Docker  Python3 + requests library    Instructions    Clone the repository  Build and run the container: docker build . -t spring4shell && docker run -p 8080:8080 spring4shell  App should now be available at http://localhost:8080/helloworld/greeting\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/52876"}, {"timestamp": "2026-09-01T20:01:43.444Z", "date_only": false, "value": "2026-09-01T20:01:43.444948Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/51079", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "9fb3f874-c851-4293-85d2-7b4bab18a562", "content": "Features    Support for lists of URLs.  Fuzzing for more than 10 new Spring4Shell payloads (previously seen tools uses only 1-2 variants).  Fuzzing for HTTP GET and POST methods.  Automatic validation of the vulnerability (https://www.kitploit.com/search/label/Vulnerability) upon discovery.  Randomized and non-intrusive payloads.  WAF Bypass payloads.\n  Description  The Spring4Shell RCE is a critical vulnerability that FullHunt has been researching since it was released. We worked with our customers in scanning their environments for Spring4Shell and Spring Cloud RCE vulnerabilities.  We're open-sourcing an open detection scanning tool for discovering Spring4Shell (CVE-2022-22965) and Spring Cloud RCE (CVE-2022-22963) vulnerabilities. This shall be used by security teams to scan their infrastructure, as well as test for WAF bypasses that can result in achieving successful exploitation (https://www.kitploit.com/search/label/Exploitation) of the organization's environment.  If your organization requires help, please contact (team at fullhunt.io) directly for a full attack surface discovery (https://www.kitploit.com/search/label/Discovery) and scanning for the Spring4Shell vulnerabilities.  Usage  Management Platform.  [\u2022] Secure your External Attack Surface with FullHunt.io.  usage: spring4shell-scan.py [-h] [-u URL] [-p PROXY] [-l USEDLIST] [--payloads-file PAYLOADS_FILE] [--waf-bypass] [--request-type REQUEST_TYPE] [--test-CVE-2022-22963]    optional arguments:    -h, --help            show this help message and exit    -u URL, --url URL     Check a single URL.    -p PROXY, --proxy PROXY                          Send requests through proxy    -l USEDLIST, --list USEDLIST                          Check a list of URLs.    --payloads-file PAYLOADS_FILE                          Payloads file - [default: payloads.txt].    --waf-bypass          Extend scans with WAF bypass payloads.    --request-type REQUEST_TYPE                          Request Type: (get, post, all) - [Default: all].    --test-CVE-2022-22963                          Test for CVE-2022-22963 (https://www.kitploit.com/search/label/CVE-2022-22963) (Spring Cloud RCE).  \">$ ./spring4shell-scan.py -h\n[\u2022] CVE-2022-22965 - Spring4Shell RCE Scanner\n[\u2022] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.\n[\u2022] Secure your External Attack Surface with FullHunt.io.\nusage: spring4shell-scan.py [-h] [-u URL] [-p PROXY] [-l USEDLIST] [--payloads-file PAYLOADS_FILE] [--waf-bypass] [--request-type REQUEST_TYPE] [--test-CVE-2022-22963]\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -u URL, --url URL     Check a single URL.\n  -p PROXY, --proxy PROXY\n                        Send requests through proxy\n  -l USEDLIST, --list USEDLIST\n                        Check a list of URLs.\n  --payloads-file PAYLOADS_FILE\n                        Payloads file - [default: payloads.txt].\n  --waf-bypass          Extend scans with WAF bypass payloads.\n  --request-type REQUEST_TYPE\n                        Request Type: (get,    post, all) - [Default: all].\n  --test-CVE-2022-22963\n                        Test for CVE-2022-22963 (Spring Cloud RCE).  Scan a Single URL  $ python3 spring4shell-scan.py -u https://spring4shell.lab.secbot.local  Discover WAF bypasses against the environment  $ python3 spring4shell-scan.py -u https://spring4shell.lab.secbot.local --waf-bypass  Scan a list of URLs  $ python3 spring4shell-scan.py -l urls.txt  Include checks for Spring Cloud RCE (CVE-2022-22963)  $ python3 spring4shell-scan.py -l urls.txt --test-CVE-2022-22963\n  Installation  $ pip3 install -r requirements.txt\n  Docker Support  git clone https://github.com/fullhunt/spring4shell-scan.git\ncd spring4shell-scan\nsudo docker build -t spring4shell-scan .\nsudo docker run -it --rm spring4shell-scan\n\n# With URL list \"urls.txt\" in current directory\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/51079"}, {"timestamp": "2026-09-01T20:01:45.722Z", "date_only": false, "value": "2026-09-01T20:01:45.722684Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/49831", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "0d34150e-0b9b-449a-9bba-de160cd020db", "content": "Exploit Collector\nSpring4Shell Code Execution\n\nhttps://4.bp.blogspot.com/-slZrAXCcTc4/WWlvSkUdx-I/AAAAAAAAINc/GD9pE2wpupUfP-XcYlxrz5jw2m91dZTOgCLcBGAs/s1600/h39.png \nPython exploit for CVE-2022-22965 that provides a prompt to the user in the style of an ssh session. The script is designed to be easy to understand and execute, with both readability and accessibility - depending on the user's choice. Designed for exploiting the vulnerability on tomcat servers. The fileDateFormat field on the server will be set and unset as part of the script which allows the exploit to be run multiple times. Cleanup may be required. It leverages a vulnerability found in the java spring framework before version 5.2, as well as in versions 5.3.0-17 an d 5.2.0-19 and running on a version of the Java Development Kit greater than or equal to 9.\n\nMD5 | e7a290b05afa996043b9cfc38a121fcb\n\nDownload\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/49831"}, {"timestamp": "2026-09-02T10:15:11.556Z", "date_only": false, "value": "2026-09-02T10:15:11.556904Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-01)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "03347ccf-25ce-40ec-9bad-3ba700375a2e"}, {"timestamp": "2026-09-05T03:00:03.966Z", "date_only": false, "value": "2026-09-05T03:00:03.966345Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/hacking_Attack/79492", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "d16cc401-b6d8-4a7a-b26b-357f165229f1", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "url": "https://t.me/hacking_Attack/79492"}, {"timestamp": "2026-09-05T16:00:04.525Z", "date_only": false, "value": "2026-09-05T16:00:04.525403Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/58331", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "18538397-9bc5-4aac-89c4-6723d7a510d6", "content": "Kali Linux Tutorials\nSpring4Shell-POC : Dockerized Spring4Shell (CVE-2022-22965) PoC Application And Exploit\n\nSpring4Shell-POC is a dockerized application that is vulnerable to the Spring4Shell vulnerability (CVE-2022-22965). Full Java source for the war is provided and modifiable, the war will get re-built whenever the docker image is built. The built WAR will then be loaded by Tomcat. There is nothing special about this application, it\u2019s a simple hello world that\u2019s based off\u00a0Spring tutorials.\n\nRequirements\n\n* Docker\n* Python3 + requests library\n\nInstructions\n\n* Clone the repository\n* Build and run the container: docker build . -t spring4shell && docker run -p 8080:8080 spring4shell\n* App should now be available at\u00a0http://localhost:8080/helloworld/greeting\n* Run the exploit.py script: python exploit.py --url \"http://localhost:8080/helloworld/greeting\"\n* Visit the created webshell! Modify the cmdGET parameter for your commands. (http://localhost:8080/shell.jsp\u00a0by default)\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/58331"}, {"timestamp": "2026-09-05T17:00:04.957Z", "date_only": false, "value": "2026-09-05T17:00:04.957228Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/56907", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "66f779c9-d086-4846-a706-98b10729a8a7", "content": "Kali Linux Tutorials\nSpring4Shell-Scan : A Fully Automated, Reliable, And Accurate Scanner For Finding Spring4Shell\n\nSpring4Shell-Scan is a fully automated, reliable, and accurate scanner for finding Spring4Shell and Spring Cloud RCE vulnerabilities.\n\nFeatures\n\n* Support for lists of URLs.\n* Fuzzing for more than 10 new Spring4Shell payloads (previously seen tools uses only 1-2 variants).\n* Fuzzing for HTTP GET and POST methods.\n* Automatic validation of the vulnerability upon discovery.\n* Randomized and non-intrusive payloads.\n* WAF Bypass payloads.\n\nDescription\n\nThe Spring4Shell RCE is a critical vulnerability that FullHunt has been researching since it was released. We worked with our customers in scanning their environments for Spring4Shell and Spring Cloud RCE vulnerabilities.\n\nWe\u2019re open-sourcing an open detection scanning tool for discovering Spring4Shell (CVE-2022-22965) and Spring Cloud RCE (CVE-2022-22963) vulnerabilities. This shall be used by security teams to scan their infrastructure, as well as test for WAF bypasses that can result in achieving successful exploitation of the organization\u2019s environment.\n\nIf your organization requires help, please contact (team at fullhunt.io) directly for a full attack surface discovery and scanning for the Spring4Shell vulnerabilities.\n\nUsage\n\n$ ./spring4shell-scan.py -h\n[\u2022] CVE-2022-22965 \u2013 Spring4Shell RCE Scanner\n[\u2022] Scanner provided by FullHunt.io \u2013 The Next-Gen Attack Surface Management Platform.\n[\u2022] Secure your External Attack Surface with FullHunt.io.\nusage: spring4shell-scan.py [-h] [-u URL] [-p PROXY] [-l USEDLIST] [\u2013payloads-file PAYLOADS_FILE] [\u2013waf-bypass] [\u2013request-type REQUEST_TYPE] [\u2013test-CVE-2022-22963]\noptional arguments:\n-h, \u2013help show this help message and exit\n-u URL, \u2013url URL Check a single URL.\n-p PROXY, \u2013proxy PROXY\nSend requests through proxy\n-l USEDLIST, \u2013list USEDLIST\nCheck a list of URLs.\n\u2013payloads-file PAYLOADS_FILE\nPayloads file \u2013 [default: payloads.txt].\n\u2013waf-bypass Extend scans with WAF bypass payloads.\n\u2013request-type REQUEST_TYPE\nRequest Type: (get, post, all) \u2013 [Default: all].\n\u2013test-CVE-2022-22963\nTest for CVE-2022-22963 (Spring Cloud RCE).\n\nScan a Single URL\n\n$ python3 spring4shell-scan.py -u https://spring4shell.lab.secbot.local\n\nDiscover WAF bypasses against the environment\n\n$ python3 spring4shell-scan.py -u https://spring4shell.lab.secbot.local \u2013waf-bypass\n\nScan a list of URLs\n\n$ python3 spring4shell-scan.py -l urls.txt\n\nInclude checks for Spring Cloud RCE (CVE-2022-22963)\n\n$ python3 spring4shell-scan.py -l urls.txt \u2013test-CVE-2022-22963\n\nInstallation\n\n$ pip3 install -r requirements.txt\n\nDocker Support\n\ngit clone https://github.com/fullhunt/spring4shell-scan.git\ncd spring4shell-scan\nsudo docker build -t spring4shell-scan .\nsudo docker run -it \u2013rm spring4shell-scan\nWith URL list \u201curls.txt\u201d in current directory\ndocker run -it \u2013rm -v $PWD:/data spring4shell-scan -l /data/urls.txt\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/56907"}, {"timestamp": "2026-09-05T22:00:05.069Z", "date_only": false, "value": "2026-09-05T22:00:05.069282Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/52876", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "f160e446-be3d-485b-83e4-6e7b8853d4ad", "content": "This is a dockerized application that is vulnerable (https://www.kitploit.com/search/label/Vulnerable) to the Spring4Shell vulnerability (https://www.kitploit.com/search/label/Vulnerability) (CVE-2022-22965). Full Java source for the war is provided and modifiable, the war will get re-built whenever the docker image is built. The built WAR will then be loaded by Tomcat. There is nothing special about this application, it's a simple hello world that's based off Spring tutorials (https://spring.io/guides/gs/handling-form-submission/).  Details: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilitiesHaving issues with the POC? Check out the LunaSec fork at: https://github.com/lunasec-io/Spring4Shell-POC, it's more actively maintained.  Requirements    Docker  Python3 + requests library    Instructions    Clone the repository  Build and run the container: docker build . -t spring4shell && docker run -p 8080:8080 spring4shell  App should now be available at http://localhost:8080/helloworld/greeting\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/52876"}, {"timestamp": "2026-09-05T22:00:05.123Z", "date_only": false, "value": "2026-09-05T22:00:05.123719Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/52874", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "3337e330-ecd4-4a0f-ba26-bc53255df907", "content": "Spring4Shell-POC - Dockerized Spring4Shell (CVE-2022-22965) PoC Application And Exploit\nhttp://www.kitploit.com/2022/05/spring4shell-poc-dockerized.html\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/52874"}, {"timestamp": "2026-09-05T22:00:05.311Z", "date_only": false, "value": "2026-09-05T22:00:05.311976Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/52890", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "de7c650b-7294-445a-b4cb-969752501af5", "content": "KitPloit - PenTest Tools!\nSpring4Shell-POC - Dockerized Spring4Shell (CVE-2022-22965) PoC Application And Exploit\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjaq3n6pTYJadYNCpjVegHxZFc8ZwiZUtKbPgpxPlbSd7vQgjUEfKFw0cO8jrAjpHsv_tzZAG_chVh9Mwrrh9UpIHbkniKAjKptmjj-rJ2uOjSxvBrPfVn3H2AZpIjCO-1Lrt4HnOxh7SS5SrMbbIttLpUzw7xDtIat1yKhbVk_0JgC8RDhwEXTMEuY/w640-h308/Spring4Shell.png This is a dockerized application that is vulnerable to the Spring4Shell vulnerability (CVE-2022-22965). Full Java source for the war is provided and modifiable, the war will get re-built whenever the docker image is built. The built WAR will then be loaded by Tomcat. There is nothing special about this application, it's a simple hello world that's based off Spring tutorials.\n\nDetails: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities\n\nHaving issues with the POC? Check out the LunaSec fork at: https://github.com/lunasec-io/Spring4Shell-POC, it's more actively maintained. Requirements1. Docker\n2. Python3 + requests library Instructions1. Clone the repository\n2. Build and run the container: docker build . -t spring4shell && docker run -p 8080:8080 spring4shell3. App should now be available at http://localhost:8080/helloworld/greeting https://blogger.googleusercontent.com/img/a/AVvXsEgiSKKOBdAf-H6x6nvFmF2wHQ0WkAKdimGQcO3ortF_UVrOhKDkUDmIr4gxFzpaEaodNjEbpOo2z05EuGygz6K7atd6sXZYvXGfs60tMvLY5ZPxKOwuFrODicy7AbrL7kskqnDMETdZ2FPvJ1mD0gw2LxfG-qch-LSC8tBo7hIW-JM4Jj9jGhkehhhD=w640-h124 1. Run the exploit.py script: python exploit.py --url \"http://localhost:8080/helloworld/greeting\"https://blogger.googleusercontent.com/img/a/AVvXsEhXbcvigqvcJMzQzqHzuPqv8kDD2hEASz5zefNLhrnslPL6PVh8EdqWR0NFrOVdonBf7kBvzydhbiiPpBmFXSQun215RFALW4ijb3ucOIgmJKqELuISNRn59h8q-FHSlsEeoc594Ns_vIAkKrrogsoVbif_ufTU9Udrr2Umykdeyz9b0o3y5DkRXVhj=w640-h50 1. Visit the created webshell! Modify the cmdGET parameter for your commands. (http://localhost:8080/shell.jsp by default) https://blogger.googleusercontent.com/img/a/AVvXsEgTxfQevfT3YeenETl-w22eGNM_pdTzRn-0Nr0fwMbrmE7CLOkf33fpWA0N4zEloY3M1qI7ja7sQ-MziwLKY0FoiMoJ1e1kPhHSTMnyCU8L358ZRZTXcLmZDM7U9FHf7YuvY_3Nu3l17zdYcxQC4C9UgkypJ82wWMrgZt1jZ1cS_-2kOH7GfPdZgu6F=w640-h118 NotesFixed! As of this writing, the container (possibly just Tomcat) must be restarted between exploitations. I'm actively trying to resolve this.\n\nRe-running the exploit will create an extra artifact file of {old_filename}_.jsp.\n\nPRs/DMs @Rezn0k are welcome for improvements! Credits* @esheavyind for help on building a PoC. Check out their writeup at: https://gist.github.com/esell/c9731a7e2c5404af7716a6810dc33e1a\n* @LunaSecIO for improving the documentation and exploit\n* @rwincey for making the exploit replayable without requiring a Tomcat restart Download Spring4Shell-POC\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/52890"}, {"timestamp": "2026-09-05T23:00:03.840Z", "date_only": false, "value": "2026-09-05T23:00:03.840793Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/51079", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "3be85c7b-a0ae-465c-8f5c-dbaa534f6710", "content": "Features    Support for lists of URLs.  Fuzzing for more than 10 new Spring4Shell payloads (previously seen tools uses only 1-2 variants).  Fuzzing for HTTP GET and POST methods.  Automatic validation of the vulnerability (https://www.kitploit.com/search/label/Vulnerability) upon discovery.  Randomized and non-intrusive payloads.  WAF Bypass payloads.\n  Description  The Spring4Shell RCE is a critical vulnerability that FullHunt has been researching since it was released. We worked with our customers in scanning their environments for Spring4Shell and Spring Cloud RCE vulnerabilities.  We're open-sourcing an open detection scanning tool for discovering Spring4Shell (CVE-2022-22965) and Spring Cloud RCE (CVE-2022-22963) vulnerabilities. This shall be used by security teams to scan their infrastructure, as well as test for WAF bypasses that can result in achieving successful exploitation (https://www.kitploit.com/search/label/Exploitation) of the organization's environment.  If your organization requires help, please contact (team at fullhunt.io) directly for a full attack surface discovery (https://www.kitploit.com/search/label/Discovery) and scanning for the Spring4Shell vulnerabilities.  Usage  Management Platform.  [\u2022] Secure your External Attack Surface with FullHunt.io.  usage: spring4shell-scan.py [-h] [-u URL] [-p PROXY] [-l USEDLIST] [--payloads-file PAYLOADS_FILE] [--waf-bypass] [--request-type REQUEST_TYPE] [--test-CVE-2022-22963]    optional arguments:    -h, --help            show this help message and exit    -u URL, --url URL     Check a single URL.    -p PROXY, --proxy PROXY                          Send requests through proxy    -l USEDLIST, --list USEDLIST                          Check a list of URLs.    --payloads-file PAYLOADS_FILE                          Payloads file - [default: payloads.txt].    --waf-bypass          Extend scans with WAF bypass payloads.    --request-type REQUEST_TYPE                          Request Type: (get, post, all) - [Default: all].    --test-CVE-2022-22963                          Test for CVE-2022-22963 (https://www.kitploit.com/search/label/CVE-2022-22963) (Spring Cloud RCE).  \">$ ./spring4shell-scan.py -h\n[\u2022] CVE-2022-22965 - Spring4Shell RCE Scanner\n[\u2022] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.\n[\u2022] Secure your External Attack Surface with FullHunt.io.\nusage: spring4shell-scan.py [-h] [-u URL] [-p PROXY] [-l USEDLIST] [--payloads-file PAYLOADS_FILE] [--waf-bypass] [--request-type REQUEST_TYPE] [--test-CVE-2022-22963]\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -u URL, --url URL     Check a single URL.\n  -p PROXY, --proxy PROXY\n                        Send requests through proxy\n  -l USEDLIST, --list USEDLIST\n                        Check a list of URLs.\n  --payloads-file PAYLOADS_FILE\n                        Payloads file - [default: payloads.txt].\n  --waf-bypass          Extend scans with WAF bypass payloads.\n  --request-type REQUEST_TYPE\n                        Request Type: (get,    post, all) - [Default: all].\n  --test-CVE-2022-22963\n                        Test for CVE-2022-22963 (Spring Cloud RCE).  Scan a Single URL  $ python3 spring4shell-scan.py -u https://spring4shell.lab.secbot.local  Discover WAF bypasses against the environment  $ python3 spring4shell-scan.py -u https://spring4shell.lab.secbot.local --waf-bypass  Scan a list of URLs  $ python3 spring4shell-scan.py -l urls.txt  Include checks for Spring Cloud RCE (CVE-2022-22963)  $ python3 spring4shell-scan.py -l urls.txt --test-CVE-2022-22963\n  Installation  $ pip3 install -r requirements.txt\n  Docker Support  git clone https://github.com/fullhunt/spring4shell-scan.git\ncd spring4shell-scan\nsudo docker build -t spring4shell-scan .\nsudo docker run -it --rm spring4shell-scan\n\n# With URL list \"urls.txt\" in current directory\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/51079"}, {"timestamp": "2026-09-06T01:00:04.876Z", "date_only": false, "value": "2026-09-06T01:00:04.876092Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/49831", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "e31a5816-bec1-41eb-89db-22873844518d", "content": "Exploit Collector\nSpring4Shell Code Execution\n\nhttps://4.bp.blogspot.com/-slZrAXCcTc4/WWlvSkUdx-I/AAAAAAAAINc/GD9pE2wpupUfP-XcYlxrz5jw2m91dZTOgCLcBGAs/s1600/h39.png \nPython exploit for CVE-2022-22965 that provides a prompt to the user in the style of an ssh session. The script is designed to be easy to understand and execute, with both readability and accessibility - depending on the user's choice. Designed for exploiting the vulnerability on tomcat servers. The fileDateFormat field on the server will be set and unset as part of the script which allows the exploit to be run multiple times. Cleanup may be required. It leverages a vulnerability found in the java spring framework before version 5.2, as well as in versions 5.3.0-17 an d 5.2.0-19 and running on a version of the Java Development Kit greater than or equal to 9.\n\nMD5 | e7a290b05afa996043b9cfc38a121fcb\n\nDownload\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "url": "https://t.me/hacking_Attack/49831"}, {"timestamp": "2026-09-10T10:00:05.839Z", "date_only": false, "value": "2026-09-10T10:00:05.839823Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cissp/5739", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "15227914-1818-482d-9025-1fb3245dc51f", "content": "Blue_Team_Techniques\n1. A list of open source web security scanners\nhttps://github.com/psiinon/open-source-web-scanners\n\n2. Script to check for Spring4Shell vulnerability\nhttps://github.com/jrgdiaz/Spring4Shell-CVE-2022-22965.py\n\n3. A fully automated, reliable, and accurate scanner for finding Spring4Shell/Spring Cloud RCE vulnerabilities\nhttps://github.com/fullhunt/spring4shell-scan", "url": "https://t.me/cissp/5739"}, {"timestamp": "2026-09-14T10:15:09.290Z", "date_only": false, "value": "2026-09-14T10:15:09.290446Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-13)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "c0d691a9-9c8c-411e-940f-6bacf1bab0fe"}, {"timestamp": "2026-09-15T10:15:10.323Z", "date_only": false, "value": "2026-09-15T10:15:10.323251Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-14)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "6a8b40be-5bd5-4d83-83d0-2001c07e1953"}, {"timestamp": "2026-09-18T04:00:06.959Z", "date_only": false, "value": "2026-09-18T04:00:06.959100Z", "kind": "sighting", "label": "Seen", "source": "Telegram/_BkbNhDHFRzkVF5tbtY3Kddn9VxORT3FDboj5Rtp-tRAsvg", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "ec7b4803-9867-4391-afad-0946ef95aebd"}, {"timestamp": "2026-09-19T00:00:38.233Z", "date_only": false, "value": "2026-09-19T00:00:38.233926Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/_BkbNhDHFRzkVF5tbtY3Kddn9VxORT3FDboj5Rtp-tRAsvg", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "b549dcd0-b1c1-4622-9da6-cb74c832e473"}, {"timestamp": "2026-09-23T03:00:14Z", "date_only": false, "value": "2026-09-23T03:00:14.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/k7P4hubjmpq89PaBAJ2zhmDTYdPdpd5wCU1UMIHoF_qLZzg", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "c2e564a3-a74d-4e54-a832-af01e0a32dbc"}, {"timestamp": "2026-09-23T03:00:14Z", "date_only": false, "value": "2026-09-23T03:00:14.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/k7P4hubjmpq89PaBAJ2zhmDTYdPdpd5wCU1UMIHoF_qLZzg", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "658a8a4f-ef85-4f59-a972-c44a3c7d693d"}, {"timestamp": "2026-09-23T12:20:06.929Z", "date_only": false, "value": "2026-09-23T12:20:06.929489Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw6q2iekh52n", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "93fc9d05-7bc0-4126-aed5-c008750aa945", "content": "CVE-2022-22965 - netbackup_appliance\nThe Spring Beans component used in several Spring Framework modules (such as spring-beans, spring-webmvc, spring-boot-starter-web, and spring-webflux)\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#netbackupappliance #oracle #Java #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mw6q2iekh52n"}, {"timestamp": "2026-10-01T00:00:00Z", "date_only": false, "value": "2026-10-01T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-01)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "70655cd6-cf12-446b-aa4b-266fb09ff6a9"}, {"timestamp": "2026-10-01T15:00:21Z", "date_only": false, "value": "2026-10-01T15:00:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/rZvAGVaSV5L1L3ErkE5G0QJMB8Vyf_5h15CuWJTGIri8NEA", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "08866bbc-34ae-4389-bea5-38054aed42e9"}, {"timestamp": "2026-10-01T15:00:21Z", "date_only": false, "value": "2026-10-01T15:00:21.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/rZvAGVaSV5L1L3ErkE5G0QJMB8Vyf_5h15CuWJTGIri8NEA", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "aa40de75-0214-4602-aa15-c8829680b2ba"}, {"timestamp": "2026-10-01T16:47:06Z", "date_only": false, "value": "2026-10-01T16:47:06+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022:1333", "record": "RHSA-2022:1333", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-01T16:47:06Z", "date_only": false, "value": "2026-10-01T16:47:06+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2022:1333", "record": "RHSA-2022:1333", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-01T16:47:06Z", "date_only": false, "value": "2026-10-01T16:47:06+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2022:1333", "record": "RHSA-2022:1333", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-01T16:47:07Z", "date_only": false, "value": "2026-10-01T16:47:07+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022:1360", "record": "RHSA-2022:1360", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-01T16:47:07Z", "date_only": false, "value": "2026-10-01T16:47:07+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022:1378", "record": "RHSA-2022:1378", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-01T16:47:07Z", "date_only": false, "value": "2026-10-01T16:47:07+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2022:1360", "record": "RHSA-2022:1360", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-01T16:47:07Z", "date_only": false, "value": "2026-10-01T16:47:07+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2022:1378", "record": "RHSA-2022:1378", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-01T16:47:07Z", "date_only": false, "value": "2026-10-01T16:47:07+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2022:1360", "record": "RHSA-2022:1360", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-01T16:47:07Z", "date_only": false, "value": "2026-10-01T16:47:07+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2022:1378", "record": "RHSA-2022:1378", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-01T16:47:08Z", "date_only": false, "value": "2026-10-01T16:47:08+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022:1379", "record": "RHSA-2022:1379", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-01T16:47:08Z", "date_only": false, "value": "2026-10-01T16:47:08+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022:1626", "record": "RHSA-2022:1626", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-01T16:47:08Z", "date_only": false, "value": "2026-10-01T16:47:08+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2022:1379", "record": "RHSA-2022:1379", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-01T16:47:08Z", "date_only": false, "value": "2026-10-01T16:47:08+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2022:1626", "record": "RHSA-2022:1626", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-01T16:47:08Z", "date_only": false, "value": "2026-10-01T16:47:08+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2022:1379", "record": "RHSA-2022:1379", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-01T16:47:08Z", "date_only": false, "value": "2026-10-01T16:47:08+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2022:1626", "record": "RHSA-2022:1626", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-01T16:47:09Z", "date_only": false, "value": "2026-10-01T16:47:09+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022:1627", "record": "RHSA-2022:1627", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-01T16:47:09Z", "date_only": false, "value": "2026-10-01T16:47:09+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2022:1627", "record": "RHSA-2022:1627", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-01T16:47:09Z", "date_only": false, "value": "2026-10-01T16:47:09+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2022:1627", "record": "RHSA-2022:1627", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-01T16:47:10Z", "date_only": false, "value": "2026-10-01T16:47:10+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2022:1306", "record": "RHSA-2022:1306", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-01T16:47:10Z", "date_only": false, "value": "2026-10-01T16:47:10+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2022:1306", "record": "RHSA-2022:1306", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-01T16:47:10Z", "date_only": false, "value": "2026-10-01T16:47:10+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2022:1306", "record": "RHSA-2022:1306", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-08T20:03:17Z", "date_only": false, "value": "2026-10-08T20:03:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/104706", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "a878ca15-4fb7-4775-ba05-7bcc68bc0eb9", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Spring4Shell #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a vulhub-spring-cve-2022-22965\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a CyberCTF\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a HCL\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-08 19:40:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nVulhub spring/CVE-2022-22965: Spring4Shell on Spring WebMVC 5.3.17, run with Isoloom\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104706"}, {"timestamp": "2026-10-17T00:00:00Z", "date_only": false, "value": "2026-10-17T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-17)", "record": "CVE-2022-22965", "field": "creation_timestamp", "uuid": "16b60ea2-5bc3-456b-b1cc-4455f75a94e8"}]}