# IS Sonar Developer edition version 9.2.4 affected by Spring Framework Vulenrability CVE-2022-22963

**URL:** <https://community.sonarsource.com/t/is-sonar-developer-edition-version-9-2-4-affected-by-spring-framework-vulenrability-cve-2022-22963/60911>\
**Category:** SonarQube Server / Community Build\
**Tags:** sonarqube, scanner\
**Created:** [April 1, 2022, 6:05am UTC](https://community.sonarsource.com/t/is-sonar-developer-edition-version-9-2-4-affected-by-spring-framework-vulenrability-cve-2022-22963/60911 "2022-04-01T06:05:46Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![rmontag\_ap](https://avatars.discourse-cdn.com/v4/letter/r/71e660/32.png) [@rmontag\_ap](https://community.sonarsource.com/u/rmontag_ap)\
**Post date:** [April 4, 2022, 3:55pm UTC](https://community.sonarsource.com/t/is-sonar-developer-edition-version-9-2-4-affected-by-spring-framework-vulenrability-cve-2022-22963/60911/4 "2022-04-04T15:55:31Z")

</div>

I would also like to see an announcement from Sonarqube - as done with Log4Shell [SonarQube, SonarCloud, and the Log4J vulnerability - #142 by jf2009](https://community.sonarsource.com/t/sonarqube-sonarcloud-and-the-log4j-vulnerability/54721/142) - about if Sonarqube 8.9.x LTS, 9.x are affected or not.

SonarQube 8.9.7 and 8.9.8 has

sonarqube-8.9.7.52159/data/web/deploy/plugins/securityjavafrontend/META-INF/lib/spring-core-5.2.13.RELEASE.jar  
sonarqube-8.9.8.54436/data/web/deploy/plugins/securityjavafrontend/META-INF/lib/spring-core-5.2.13.RELEASE.jar

which caused our scanner to trigger an incident regarding the CVE.

**UPDATE** : [SonarQube, SonarCloud, and Spring4Shell](https://community.sonarsource.com/t/sonarqube-sonarcloud-and-spring4shell/60926)

---

_[View the full topic](https://community.sonarsource.com/t/is-sonar-developer-edition-version-9-2-4-affected-by-spring-framework-vulenrability-cve-2022-22963/60911)._