CVE-2010-1622

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

CVSS v2.0

6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P

EPSS

51.85% chance of exploitation in the next 30 days, 99th percentile

Published

2010-06-21

Updated

2024-08-07

Proof-of-concept exploits (7)

• http://www.exploit-db.com/exploits/13918
• DDuarte/springshell-rce-poc19★ · 2023-04-18
• E-bounce/cve-2010-1622_learning_environment2★ · 2023-02-20
• HandsomeCat00/Spring-CVE-2010-16220★ · 2022-12-05
• cxzero/CVE-2022-22965-spring4shell1★ · 2023-12-21
• gitrobtest/Java-Security81★ · 2019-09-19
• gokul-ramesh/Spring4Shell-PoC-exploit1★ · 2023-03-17

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/13918

References

• CVE Record
• NVD entry

Related

• CVE-2022-22965
• CVE-2022-42889
• CVE-2015-1427
• CVE-2022-0824
• CVE-2022-0829
• CVE-2010-1611