CVE-2022-22963 - Has a Cisco Product Impact list been announced?

[ChrisB-IP]

Hi, just started hearing about CVE-2022-22963 "Remote code execution in Spring Cloud Function by malicious Spring Expression" (https://tanzu.vmware.com/security/cve-2022-22963). Has Cisco made any statement regarding which products are affected and what steps need to be taken? My particular concern is with regards to Networking and Unified Comms.

[Leo Laohoo]

This news just broke around 24-hours ago.  Give everyone some time to digest and investigate.

Ask again on Monday.

[Priyank Agrawal]

Cisco is aware of the vulnerability "CVE-2022-22963: Spring Expression Resource Access Vulnerability". We are following our well-established process to investigate all aspects of the issue. If something is found that our customers need to be aware of and respond to, we will communicate via our established disclosure process.

[ygao]

What about cve-2022-22965? Any cisco product got affected? Thanks. 

[Priyank Agrawal]

Cisco is aware of the vulnerability identified by CVE ID CVE-2022-22965 and with the title "Spring Framework RCE via Data Binding on JDK 9+". We are following our well-established process to investigate all aspects of the issue. If something is found that our customers need to be aware of and respond to, we will communicate via our established disclosure process.

[Leo Laohoo · Accepted solution]

Vulnerability in Spring Framework Affecting Cisco Products (CVSS:  9.8) 

Vulnerability in Spring Cloud Function Framework Affecting Cisco Products (CVSS:  9.8) 

Exploitation and Public Announcements

The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerability described in this advisory.

[ChrisB-IP]

Excellent, thanks

[Leo Laohoo]

---

@ChrisB-IP wrote:

Excellent, thanks

---

Not so fast.  VMWare just released a few more:  VMware Workspace ONE Access, Identity Manager and vRealize Automation updates address multiple vulnerabilities.

CVSS Score:  9.8