CVEvulnerability

CVE-2022-31691

9.8 CRITICAL Published 2022-11-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-11-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94

Description

Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certain circumstances allows for potentially harmful remote code execution by the attacker.

Affected configurations

• vmware bosh editor (>= 1.0.0 < 1.40.0) • vmware cloudfoundry manifest yml support (>= 1.0.0 < 1.40.0) • vmware concourse ci pipeline editor (>= 1.0.0 < 1.40.0) • vmware spring boot tools (>= 1.0.0 < 1.40.0) • vmware spring tools (>= 4.0.0 < 4.16.1)

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References