CVE-2022-31691

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certain circumstances allows for potentially harmful remote code execution by the attacker.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Nov 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-316929.8Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or includ CVE-2022-316935.5VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. A mali CVE-2022-316947.3InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent directory when displayi CVE-2022-316968.8VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local acce CVE-2022-316975.5The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with a CVE-2022-316985.3The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port CVE-2022-316993.3VMware ESXi contains a heap-overflow vulnerability. A malicious local actor with restricted privileges within a sandbox process may exploit CVE-2022-31707.8An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not CVE-2022-317007.2VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. VMware has evaluated the seve CVE-2022-317015.3VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this is CVE-2022-317029.8vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious actor with network acce CVE-2022-317037.5The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operati