Spring4Shell Vulnerability - CVE-2022-22965

[fraser-nds]

Recently noticed a software vulnerability that affects JAVA applications. Known as Spring4Shell it's been in the news recently:
https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/
https://www.computerweekly.com/news/252515360/Spring4Shell-zero-day-sprung-on-security-teams
https://tanzu.vmware.com/security/cve-2022-22965

As Mirth Connect is a JAVA application, wondering if anyone has insight into whether it's affected. I've done some initial investigation and couldn't find any direct references to the Spring framework, but finding it hard to rule out it's use.

Wondering if anyone with more experience in the codebase than me can comment?

Many Thanks,
Fraser

[jonbartels]

You found the correct solution. MC does not use Spring. https://github.com/nextgenhealthcare/connect/search?q=spring&type=code

[discofris]

Also, MC uses Jetty as the container servlet.
CVE-2022-22965 only affects Tomcat.