On this page

Atomicorp WAF Rule 337209

Rule Summary

  • Rule ID: 337209
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules - Virtual Just In Time Patch: Java remote code injection blocked
  • Observed CWEs: CWE-20 (3), CWE-74 (5), CWE-77 (2), CWE-78 (3), CWE-79 (2), CWE-89 (3), CWE-94 (13), CWE-284 (1), CWE-287 (1), CWE-288 (2), CWE-295 (2), CWE-306 (1), CWE-352 (1), CWE-434 (1), CWE-611 (1), CWE-917 (3), CWE-1321 (1)
  • Revision: 5
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Request surfaces: Request URI, Request arguments, JSON request data, SOAP request data, XML request data
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “Virtual Just In Time Patch: Java remote code injection blocked” in the request URI, request arguments, JSON request data, SOAP request data, XML request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVEVulnerabilityProductCVSSSeverity
CVE-2022-22947Spring Cloud Gateway Actuator API SpEL Code Injection (CVE-2022-22947)spring cloud gateway10.0 (v3.1)Critical
CVE-2022-24816GeoServer Remote Code Injection caused by JAI-EXT (CVE-2022-24816/CVE-2023-35042)jai-ext10.0 (v3.1)Critical
CVE-2012-0391Apache Struts Remote Command Executionstruts9.8 (v3.1)Critical
CVE-2013-2251Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Executionarchiva9.8 (v3.1)Critical
CVE-2017-12611Apache Struts2 S2-053 - Remote Code Executionstruts9.8 (v3.0)Critical
CVE-2017-8046Spring Data REST Remote Code Execution (CVE-2017-8046)spring boot9.8 (v3.0)Critical
CVE-2018-6220Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2018-6223Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2018-6228Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2018-6229Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2019-0230Apache Struts 2 Forced Multi OGNL Evaluationstruts9.8 (v3.1)Critical
CVE-2019-7238Nexus Repository Manager 3 Unauthenticated Remote Code Execution (CVE-2019-7238)nexus repository manager9.8 (v3.1)Critical
CVE-2020-14750Oracle WebLogic Server Administration Console Handle RCEweblogic server9.8 (v3.1)Critical
CVE-2020-14882Oracle WebLogic Server Administration Console Handle RCEweblogic server9.8 (v3.1)Critical
CVE-2020-17530Struts2 S2-061 Remote Code Execution Vulnerablity (CVE-2020-17530)struts9.8 (v3.1)Critical
CVE-2022-2143Advantech iView NetworkServlet Command Injectioniview9.8 (v3.1)Critical
CVE-2022-26134Atlassian Confluence Pre-Auth Remote Code Execution via OGNL Injection (CVE-2022-26134)confluence data center9.8 (v3.1)Critical
CVE-2022-42889Apache Commons Text RCEcommons text9.8 (v3.1)Critical
CVE-2023-38646Metabase Pre-Auth JDBC Remote Code Execution (CVE-2023-38646)metabase9.8 (v3.1)Critical
CVE-2024-0195SpiderFlow Crawler Platform - Remote Code Executionspider-flow9.8 (v3.1)Critical
CVE-2024-27348Apache HugeGraph Unauthenticated Remote Code Execution (CVE-2024-27348)hugegraph9.8 (v3.1)Critical
CVE-2024-28255OpenMetadata authentication bypass and SpEL injection exploit chainopenmetadata9.8 (v3.1)Critical
CVE-2024-7314AJ-Report < 1.4.1 - Remote Code Executionreport9.8 (v3.1)Critical
CVE-2025-56819Datart v1.0.0-rc.3 - Remote Code Executiondatart9.8 (v3.1)Critical
CVE-2013-1965Apache Struts2 S2-012 RCEstruts9.3 (v2.0)High
CVE-2026-58138Orkes Conductor 3.21.21-3.30.1 - Remote Code Executionconductor9.3 (v4.0)Critical
CVE-2021-21479SCIMono <0.0.19 - Remote Code Executionscimono9.1 (v3.1)Critical
CVE-2018-10054H2 Web Interface Create Alias RCEdatomic8.8 (v3.1)High
CVE-2018-6224Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway8.8 (v3.0)High
CVE-2021-22053Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Executionspring cloud netflix8.8 (v3.1)High
CVE-2021-25646Apache Druid Embedded Javascript Remote Code Execution (CVE-2021-25646)druid8.8 (v3.1)High
CVE-2023-34468Apache NiFi H2 Connection String Remote Code Executionnifi8.8 (v3.1)High
CVE-2024-28253OpenMetaData - SpEL Injection in PUT /api/v1/policiesopenmetadata8.8 (v3.1)High
CVE-2024-28254OpenMetadata authentication bypass and SpEL injection exploit chainopenmetadata8.8 (v3.1)High
CVE-2025-4428Ivanti EPMM Authentication Bypass for Expression Language Remote Code Executionendpoint manager mobile8.8 (v3.1)High
CVE-2016-3081Apache Struts Dynamic Method Invocation Remote Code Executionagile controller-campus firmware8.1 (v3.1)High
CVE-2017-12615Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)tomcat8.1 (v3.1)High
CVE-2018-11776Apache Struts2 S2-057 - Remote Code Executionstruts8.1 (v3.1)High
CVE-2018-6221Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway8.1 (v3.0)High
CVE-2018-6222Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway7.8 (v3.0)High
CVE-2019-17558Apache Solr Remote Code Execution via Velocity Templatesolr7.5 (v3.1)High
CVE-2025-4427Ivanti EPMM Authentication Bypass for Expression Language Remote Code Executionendpoint manager mobile7.5 (v3.1)High
CVE-2019-0193Apache Solr Remote Command Execution (CVE-2019-0193)solr7.2 (v3.1)High
CVE-2020-14883Oracle WebLogic Server Administration Console Handle RCEweblogic server7.2 (v3.1)High
CVE-2007-4556OpenSymphony XWork/Apache Struts2 - Remote Code Executionxwork6.8 (v2.0)Medium
CVE-2012-0392Apache Struts2 S2-008 RCEstruts6.8 (v2.0)Medium
CVE-2018-6230Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway6.8 (v3.0)Medium
CVE-2018-6219Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway6.5 (v3.0)Medium
CVE-2018-6226Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway5.4 (v3.0)Medium
CVE-2018-6227Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway5.4 (v3.0)Medium
CVE-2018-6225Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway4.3 (v3.0)Medium
CVE-2026-6125Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injectionwarm-flow2.1 (v4.0)Low

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWERelated Published CVEs
CWE-20CVE-2017-12611 , CVE-2017-8046 , CVE-2018-10054
CWE-74CVE-2013-2251 , CVE-2018-6220 , CVE-2021-21479 , CVE-2019-17558 , CVE-2026-6125
CWE-77CVE-2022-2143 , CVE-2016-3081
CWE-78CVE-2025-56819 , CVE-2024-28254 , CVE-2018-6222
CWE-79CVE-2018-6226 , CVE-2018-6227
CWE-89CVE-2018-6228 , CVE-2018-6229 , CVE-2018-6230
CWE-94CVE-2022-22947 , CVE-2022-24816 , CVE-2012-0391 , CVE-2022-42889 , CVE-2024-0195 , CVE-2013-1965 , CVE-2026-58138 , CVE-2021-22053 , CVE-2023-34468 , CVE-2024-28253 , CVE-2025-4428 , CVE-2019-0193 , CVE-2026-6125
CWE-284CVE-2024-27348
CWE-287CVE-2024-28255
CWE-288CVE-2024-7314 , CVE-2025-4427
CWE-295CVE-2018-6221 , CVE-2018-6219
CWE-306CVE-2018-6223
CWE-352CVE-2018-6224
CWE-434CVE-2017-12615
CWE-611CVE-2018-6225
CWE-917CVE-2022-22947 , CVE-2020-17530 , CVE-2022-26134
CWE-1321CVE-2019-0230