Vulnerability Overview
CVE-2022-22963 (CVSS 9.8 (Unofficial) – Critical) – Remote code execution in Spring Cloud Function by malicious Spring Expression
A Critical severity vulnerability impacting multiple versions impacts Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions was disclosed publicly on March 28th.
In Spring 3.1.6, 3.2.2 and older version when using routing functionality, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
CVE-2022-22965 (CVSS – 8.1 – High) – Spring Framework RCE via Data Binding on JDK 9+ “Spring4Shell”
A High severity vulnerability was responsibly reported to VMware on 29th March. A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Spring Framework version 5.3.0 to 5.3.17 & 5.2.0 to 5.2.19 are reported as being vulnerable. Older, unsupported versions are also affected.
eBooks
ZTNA InfographicDownload*(*Details required)
Word Press Compromise – SolarMarker MalwareDownload*(*Details required)
Fortinet Cybersecurity Mesh – Solution BriefDownload*(*Details required)
Fortinet Mesh Cybersecurity ChecklistDownload*(*Details required)
EMNS essentialsDownload*(*Details required)
Exploring the 6 myths of SIEM – eBookDownload*(*Details required)
Struggling To Securely Keep Up With Digital Acceleration – EbookDownload*(*Details required)
Security Advisory: Spring users face two new zero-day vulnerabilitiesDownload*(*Details required)
Ward’s Breach Attack SimulationDownload*(*Details required)
Ransomware Security Advisory – May 2021Download*(*Details required)
Breach Attack Simulation and Secure Remote WorkingDownload*(*Details required)
Secure Remote Access – FortinetDownload*(*Details required)
Remote Working Security Assessment (RWSA)Download*(*Details required)
Secure Access Setup and ConfigurationDownload*(*Details required)
Intelligence-led Red Team Cybersecurity Testing (TIBER-IE)Download*(*Details required)
Security Roadmap 2020Download*(*Details required)
Emergency Incident Response ServiceDownload*(*Details required)
Security Device ManagementDownload*(*Details required)
NIS DirectiveDownload*(*Details required)
Office 365 Security AssessmentDownload*(*Details required)
ISO 27001 ConsultancyDownload*(*Details required)
PCI DSSDownload*(*Details required)
Continuous Full-Stack Security TestingDownload*(*Details required)
Security Incident & Event ManagementDownload*(*Details required)
Awareness, Discovery & Control of Cloud Service UsageDownload*(*Details required)
