On this page

Atomicorp WAF Rule 337210

Rule Summary

  • Rule ID: 337210
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules - Virtual Just In Time Patch: Java RCE attack blocked
  • Observed CWEs: CWE-20 (1), CWE-74 (2), CWE-78 (1), CWE-79 (2), CWE-89 (3), CWE-94 (11), CWE-288 (1), CWE-295 (2), CWE-306 (1), CWE-352 (1), CWE-434 (1), CWE-611 (1), CWE-917 (3), CWE-1321 (1)
  • Revision: 8
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Request surfaces: Request arguments, JSON request data, SOAP request data, XML request data
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “Virtual Just In Time Patch: Java RCE attack blocked” in the request arguments, JSON request data, SOAP request data, XML request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVEVulnerabilityProductCVSSSeverity
CVE-2022-22947Spring Cloud Gateway Actuator API SpEL Code Injection (CVE-2022-22947)spring cloud gateway10.0 (v3.1)Critical
CVE-2022-24816GeoServer Remote Code Injection caused by JAI-EXT (CVE-2022-24816/CVE-2023-35042)jai-ext10.0 (v3.1)Critical
CVE-2012-0391Apache Struts Remote Command Executionstruts9.8 (v3.1)Critical
CVE-2017-8046Spring Data REST Remote Code Execution (CVE-2017-8046)spring boot9.8 (v3.0)Critical
CVE-2018-6220Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2018-6223Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2018-6228Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2018-6229Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2019-0230Apache Struts 2 Forced Multi OGNL Evaluationstruts9.8 (v3.1)Critical
CVE-2019-7238Nexus Repository Manager 3 Unauthenticated Remote Code Execution (CVE-2019-7238)nexus repository manager9.8 (v3.1)Critical
CVE-2020-11975Apache Unomi - Remote Code Executionunomi9.8 (v3.1)Critical
CVE-2020-14750Oracle WebLogic Server Administration Console Handle RCEweblogic server9.8 (v3.1)Critical
CVE-2020-14882Oracle WebLogic Server Administration Console Handle RCEweblogic server9.8 (v3.1)Critical
CVE-2020-17530Struts2 S2-061 Remote Code Execution Vulnerablity (CVE-2020-17530)struts9.8 (v3.1)Critical
CVE-2022-22965Spring Framework Data Binding Remote Code Execution on JDK 9+ (CVE-2022-22965)spring framework9.8 (v3.1)Critical
CVE-2022-42889Apache Commons Text RCEcommons text9.8 (v3.1)Critical
CVE-2023-38646Metabase Pre-Auth JDBC Remote Code Execution (CVE-2023-38646)metabase9.8 (v3.1)Critical
CVE-2024-0195SpiderFlow Crawler Platform - Remote Code Executionspider-flow9.8 (v3.1)Critical
CVE-2010-1871JBoss Seam 2 File Upload and Executejboss enterprise application platform8.8 (v3.1)High
CVE-2018-6224Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway8.8 (v3.0)High
CVE-2021-25646Apache Druid Embedded Javascript Remote Code Execution (CVE-2021-25646)druid8.8 (v3.1)High
CVE-2023-34468Apache NiFi H2 Connection String Remote Code Executionnifi8.8 (v3.1)High
CVE-2024-28253OpenMetaData - SpEL Injection in PUT /api/v1/policiesopenmetadata8.8 (v3.1)High
CVE-2025-4428Ivanti EPMM Authentication Bypass for Expression Language Remote Code Executionendpoint manager mobile8.8 (v3.1)High
CVE-2017-12615Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)tomcat8.1 (v3.1)High
CVE-2018-6221Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway8.1 (v3.0)High
CVE-2018-6222Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway7.8 (v3.0)High
CVE-2019-17558Apache Solr Remote Code Execution via Velocity Templatesolr7.5 (v3.1)High
CVE-2025-4427Ivanti EPMM Authentication Bypass for Expression Language Remote Code Executionendpoint manager mobile7.5 (v3.1)High
CVE-2019-0193Apache Solr Remote Command Execution (CVE-2019-0193)solr7.2 (v3.1)High
CVE-2020-14883Oracle WebLogic Server Administration Console Handle RCEweblogic server7.2 (v3.1)High
CVE-2012-0392Apache Struts2 S2-008 RCEstruts6.8 (v2.0)Medium
CVE-2018-6230Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway6.8 (v3.0)Medium
CVE-2015-5603Atlassian HipChat for Jira Plugin Velocity Template Injectionhipchat6.5 (v2.0)Medium
CVE-2018-6219Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway6.5 (v3.0)Medium
CVE-2018-6226Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway5.4 (v3.0)Medium
CVE-2018-6227Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway5.4 (v3.0)Medium
CVE-2018-6225Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway4.3 (v3.0)Medium

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWERelated Published CVEs
CWE-20CVE-2017-8046
CWE-74CVE-2018-6220 , CVE-2019-17558
CWE-78CVE-2018-6222
CWE-79CVE-2018-6226 , CVE-2018-6227
CWE-89CVE-2018-6228 , CVE-2018-6229 , CVE-2018-6230
CWE-94CVE-2022-22947 , CVE-2022-24816 , CVE-2012-0391 , CVE-2022-22965 , CVE-2022-42889 , CVE-2024-0195 , CVE-2023-34468 , CVE-2024-28253 , CVE-2025-4428 , CVE-2019-0193 , CVE-2015-5603
CWE-288CVE-2025-4427
CWE-295CVE-2018-6221 , CVE-2018-6219
CWE-306CVE-2018-6223
CWE-352CVE-2018-6224
CWE-434CVE-2017-12615
CWE-611CVE-2018-6225
CWE-917CVE-2022-22947 , CVE-2020-17530 , CVE-2010-1871
CWE-1321CVE-2019-0230