Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Spring4Shell is CVE-2022-22965, a remote-code-execution vulnerability in Spring Framework’s data binding. Spring’s published exploit scenario concerns Spring MVC or Spring WebFlux applications running on JDK 9 or later, deployed to Apache Tomcat as a WAR, and using affected Spring Framework versions. Check the exact framework version and deployment, then apply the Spring or product vendor’s fix. Updating software does not replace checking for signs of compromise.
What is Spring4Shell?
Spring4Shell is the common name for CVE-2022-22965, which Spring titled “Spring Framework RCE via Data Binding on JDK 9+.” It involves HTTP request data binding reaching sensitive application internals in certain Spring MVC or Spring WebFlux deployments. Microsoft’s analysis of the published proof of concept describes changing Tomcat access-log settings to write a JSP web shell into a path accessible to the application.
As an Amazon Associate I earn from qualifying purchases.
The vulnerability is serious, but that does not mean every Spring application is exploitable. Exposure depends on the framework version and deployment details, and a framework version number alone may not settle the question.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Which systems are affected?
Spring’s affected and fixed versions
Spring’s March 31, 2022 security advisory lists Spring Framework versions 5.3.0 through 5.3.17 and 5.2.19.RELEASE and earlier as affected. It lists 5.3.18 and 5.2.20.RELEASE as fixed. These are the versions specified in that advisory; for a current deployment, also check the vendor’s current product guidance and supported upgrade path.
#1 Best Overall
| Spring Framework version | Spring advisory status |
|---|---|
| 5.3.0–5.3.17 | Affected |
| 5.3.18 | Fixed version listed |
| 5.2.19.RELEASE and earlier | Affected |
| 5.2.20.RELEASE | Fixed version listed |
Source: Spring’s security advisory, published March 31, 2022.
Requirements in the published exploit scenario
Spring describes the specific exploit scenario as requiring all of the following:
- JDK 9 or later.
- Apache Tomcat as the servlet container.
- WAR packaging.
- A dependency on
spring-webmvcorspring-webflux.
Spring says a default Spring Boot executable JAR is not vulnerable to that specific exploit. The advisory also cautions that the underlying vulnerability may have other ways to be exploited. Do not treat executable-JAR packaging, or the absence of one listed prerequisite, as proof that an application or product is safe without considering its full configuration and vendor advice.
How to check whether your application may be exposed
- Identify the software owner and product. Establish whether your team manages the application directly or whether it is bundled in a commercial or vendor-managed product.
- Find the Spring Framework version actually deployed. Inspect the resolved dependencies and packaged application, not only a version declared in a build file. Check for transitive or embedded copies as well as the application’s direct dependencies.
- Record the deployment details. Confirm the JDK version, whether the application uses Spring MVC or WebFlux, the servlet container, and whether it is deployed as a WAR or a Spring Boot executable JAR.
- Compare the version and configuration with the advisory. The listed affected ranges are a starting point; assess the specific exploit prerequisites and consult the responsible vendor rather than making a decision from one version string alone.
- For third-party products, ask the supplier. Ask whether the product uses Spring Core or includes Spring Framework, which versions are affected, and which product update addresses CVE-2022-22965. Follow that product’s own security advisory and remediation instructions.
NCSC-NL recommends checking with suppliers about Spring Core use and warns that scanner results do not guarantee that vulnerable systems are absent. A scan can help with discovery, but it is not a substitute for dependency and vendor checks. See the NCSC-NL Spring4Shell guidance.
How to fix Spring4Shell
Upgrade Spring Framework directly
For an affected application you manage, upgrade to the corresponding fixed Spring Framework release listed by Spring: 5.3.18 or 5.2.20.RELEASE. Spring’s advisory says no additional steps are necessary after upgrading to those versions. In practice, use the supported update path for your application and verify that the fixed version is the one resolved and deployed, not merely the one requested in a build configuration.
Use the product vendor’s update for bundled software
If Spring is inside another vendor’s product, apply the product-specific patch or remediation. A framework-level version list may not describe how the product packages dependencies or how its supported update should be installed. Confirm remediation status with the supplier; do not infer safety from a generic scan or from the fact that the product is not directly managed by your team.
Rank #3
If an update cannot be applied immediately
Spring links mitigation steps for applications unable to upgrade from its security advisory. Use those steps as a temporary risk-reduction measure, and follow the affected product vendor’s instructions where applicable. A workaround is not the same as installing a fixed version; plan and verify the update rather than treating mitigation as closure.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Severity and exploitation context
The National Vulnerability Database (NVD) gives CVE-2022-22965 a CVSS 3.1 base score of 9.8, rated Critical, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD also records it as included in CISA’s Known Exploited Vulnerabilities Catalog. NVD’s entry gives April 4, 2022 as the catalog addition date and April 25, 2022 as the associated due date; these are historical catalog dates, not a current remediation deadline. Severity and catalog status signal the importance of prompt remediation, but do not establish whether a particular system is exposed or compromised. See the NVD entry for CVE-2022-22965.
How to check for signs of compromise
Patch status and compromise status are separate questions. NCSC-NL advises checking logs on systems that were vulnerable and on systems that have already been patched. Review relevant application and server records for unexpected activity, including signs consistent with the published proof of concept, such as an unexpected JSP file or suspicious changes to Tomcat access-log configuration. The exact evidence available depends on the application and logging setup.
Microsoft described a non-malicious request test as an indicator for susceptibility to the published proof of concept. It is not a comprehensive or definitive security test: systems within the impacted scope should still be treated as vulnerable until assessed and remediated. Microsoft also documented Defender, firewall, and WAF detection options; these are product-specific measures and do not replace fixing affected software. Its analysis reflects reporting from April 2022, not a statement of current threat activity. See Microsoft’s Spring4Shell vulnerability guidance.
If logs or other evidence suggest a web shell or unauthorized access, involve your organization’s incident-response process. Assess affected credentials, systems, and data under your established procedures; the cited guidance does not prescribe one universal post-incident checklist for every deployment.
Or skip the browser setup
For a screenshot workflow unrelated to Spring4Shell remediation, ScreenshotNeo is a website screenshot API and MCP server; it does not detect, patch, or investigate this vulnerability. Its API can capture a URL in one request. This example saves a WebP screenshot of the Spring advisory page:
Best Value
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement -o shot.webpSee the ScreenshotNeo API documentation for options and response details. ScreenshotNeo removes supported consent banners, newsletter popups, and chat widgets before capture; each cleanup step can be turned off. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed, and response headers state the page verdict and billing status. Its MCP server includes tools for AI agents to take screenshots and capture PDFs. The free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000. For screenshot use—not vulnerability remediation—sign up for ScreenshotNeo’s free plan.
Frequently Asked Questions
Does a clean vulnerability scan prove an application is safe from Spring4Shell?
No. NCSC-NL warns that scanner results do not guarantee that vulnerable systems are absent; confirm dependencies, deployment details, and vendor status.
Does ScreenshotNeo fix or test for Spring4Shell?
No. ScreenshotNeo captures website screenshots; it is not a vulnerability scanner, patch, or incident-response tool.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
