CVE-2022-31691

published 2022-11-04

CVE-2022-31691: Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and…

Priority P2 58 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certain circumstances allows for potentially harmful remote code execution by the attacker.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
vmware	bosh_editor	>= 1.0.0 < 1.40.0	1.40.0
vmware	cloudfoundry_manifest_yml_support	>= 1.0.0 < 1.40.0	1.40.0
vmware	concourse_ci_pipeline_editor	>= 1.0.0 < 1.40.0	1.40.0
vmware	spring_boot_tools	>= 1.0.0 < 1.40.0	1.40.0
vmware	spring_tools	>= 4.0.0 < 4.16.1	4.16.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94