Spring4Shell CVE-2022-22965 vulnerability assesment

ROB-EX is unaffected by the Spring4Shell vulnerability

We have conducted an internal security investigation to assess if ROB-EX is affected by the Spring4Shell vulnerability. The conclusion is that no ROB-EX module or component between ROB-EX v4.2 – ROB-EX v7.2 is affected (we have not investigated versions older than v4.2).

The detailed results from our internal security investigation are the following

• The only ROB-EX product using Spring is Multiuser Server 7.0 and Multiuser Server 7.2
• The exploit requires use of Java 9 and higher to be exploited.
  • The ROB-EX 7.0 server uses Java 8 and is thus not affected by this exploit
  • The ROB-EX 7.2 server uses Java 11. This server version uses Spring Boot v2.6.6 or newer where the Spring4Shell vulnerability is fixed.
• The exploit requires a Servlet container packaged as WAR to be exploited. The ROB-EX 7.0 and 7.2 server is packaged as a JAR and is thus not affected by this exploit

Our conclusion is that ROB-EX customers will not have to take additional actions to secure their ROB-EX installation in relation to the Spring4Shell vulnerability.