CVE-2022-22965 & CVE-2022-22963 vulnerability on NIM
search cancel

CVE-2022-22965 & CVE-2022-22963 vulnerability on NIM


Article ID: 238955


Updated On:


DX Operational Intelligence CA Spectrum DX Unified Infrastructure Management (Nimsoft / UIM) CA Unified Infrastructure Management SaaS (Nimsoft / UIM) CA Service Operations Insight (SOI) CA Identity Governance Application Lifecycle Conductor Compliance Event Manager Trusted Access Manager for Mainframe


Two vulnerabilities CVE-2022-22965 and CVE-2022-22963 have been reported on Spring

CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+
 A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote
code execution (RCE) via data binding. The specific exploit requires the application to run on
Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar,
i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is
more general, and there may be other ways to exploit it.
CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring
 In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using
routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-
expression that may result in remote code execution and access to local resources.

What is the impact on NIM?
No Impact


Release: NIM SM 3.2.331


Our engineering team has analyzed these vulnerabilities and confirmed that NIM is not
impacted by these vulnerabilities as we are not running our applications on JDK9+ and are
not using Spring Cloud Function libraries.

NIM is NOT vulnerable to this zero-day exploit as it ships JRE8.

NIM doesn’t use Spring Cloud Foundation library and is NOT vulnerable to this exploit.