SAP Knowledge Base Article - Preview

3190541 - Spring4Shell (CVE-2022-22965): Zero-Day Vulnerability in Spring Framework on FIM

Symptom

Is FIM affected by Spring4Shell(CVE-2022-22965) vulnerability?

  • CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+
  • A zero-day remote code execution (RCE) vulnerability has come to light in the Spring framework.
  • Spring is a software framework for building Java applications, including web apps on top of the Java EE (Enterprise Edition) platform.
  • Additional details of the flaw, dubbed "SpringShell" and "Spring4Shell," have been withheld to prevent exploitation attempts and until a fix is in place by the framework's maintainers, Spring.io, a subsidiary of VMware. It's also yet to be assigned a Common Vulnerabilities and Exposures (CVE) identifier.


Read more...

Environment

SAP Financial information Management FIM 10.0

Product

SAP Data Services 4.1

Keywords

KBA , EPM-FIM-GEN , General , Problem

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.