PT-2022-26937 · Spring+1 · Spring Framework+3

Published 2022-12-05 · Updated 2022-12-21 · CVE-2022-43484

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TERASOLUNA Global Framework version 1.0.0 TERASOLUNA Server Framework for Java (Rich) versions 2.0.0.2 through 2.0.5.1

Description The issue is caused by an improper input validation in the binding mechanism of Spring MVC, which can lead to arbitrary code execution with the privileges of the application when processing a specially crafted file. This is due to the use of an old version of the Spring Framework that contains the vulnerability.

Recommendations For TERASOLUNA Global Framework version 1.0.0, update to TERASOLUNA Global Framework 1.0.1 or later, which uses Spring Framework 3.2.10. For TERASOLUNA Server Framework for Java (Rich) versions 2.0.0.2 through 2.0.5.1, update to TERASOLUNA Server Framework for Java 5.7.1.SP1, which uses Spring Framework 5.3.18.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-43484

GHSA-Q5J9-F95W-F4PR

Affected Products

Spring Framework

Spring Mvc

Terasoluna Global Framework

Terasoluna Server Framework For Java

References · 9

• 🔥 http://terasolunaorg.github.io/vulnerability/cve-2022-43484.html · Exploit
• https://osv.dev/vulnerability/CVE-2022-43484 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43484 · Security Note
• https://osv.dev/vulnerability/GHSA-q5j9-f95w-f4pr · Vendor Advisory
• https://github.com/spring-projects/spring-framework/issues/15724 · Note
• https://github.com/terasolunaorg/terasoluna-gfw · Note
• https://t.me/cvenotify/40334 · Telegram Post
• https://jvn.jp/en/jp/JVN54728399/index.html · Note
• https://osdn.net/projects/terasoluna/wiki/cve-2022-43484 · Note