CVE-2022-22965
Description
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Summary dbcve.org
Remote code execution in Spring MVC or Spring WebFlux applications running on JDK 9+ via unsafe data binding, with the specific known exploit vector requiring a WAR deployment on Tomcat. Spring Boot executable jar deployments are not vulnerable to the known exploit, though the underlying data-binding issue is more general and may have other attack paths.
Mitigation
Upgrade the Spring Framework to a patched version per the Spring advisory. If upgrading is not immediately feasible, switch the deployment packaging from a WAR on Tomcat to a Spring Boot executable jar to block the known exploit vector, and restrict access to the affected application as an interim measure.