CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-22963
Critical (9.8) in VMware Tanzu Spring Cloud. In CISA KEV since 2022-08-25. EPSS 100% chance of exploitation in the next 30 days. Fixed in org.springframework.cloud:spring-cloud-function-context 3.1.7, 3.2.3.
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Severity
- EPSS
- 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2022-08-25, due 2022-09-15
- CWEs
- CWE-917, CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- oracle:banking_branch
- oracle:banking_cash_management
- oracle:banking_corporate_lending_process_management
- oracle:banking_credit_facilities_process_management
- oracle:banking_electronic_data_exchange_for_corporates
- oracle:banking_liquidity_management
- oracle:banking_origination
- oracle:banking_supply_chain_finance
- oracle:banking_trade_finance_process_management
- oracle:banking_virtual_account_management
- oracle:communications_cloud_native_core_automated_test_suite
- oracle:communications_cloud_native_core_console
- oracle:communications_cloud_native_core_network_exposure_function
- oracle:communications_cloud_native_core_network_function_cloud_native_environment
- oracle:communications_cloud_native_core_network_repository_function
- oracle:communications_cloud_native_core_network_slice_selection_function
- oracle:communications_cloud_native_core_policy
- oracle:communications_cloud_native_core_security_edge_protection_proxy
- oracle:communications_cloud_native_core_unified_data_repository
- oracle:communications_communications_policy_management
- oracle:financial_services_analytical_applications_infrastructure
- oracle:financial_services_behavior_detection_platform
- oracle:financial_services_enterprise_case_management
- oracle:mysql_enterprise_monitor
- oracle:product_lifecycle_analytics
- oracle:retail_xstore_point_of_service
- oracle:sd-wan_edge
- vmware:spring_cloud_function
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6v73-fgf6-w5j7 | Maven | org.springframework.cloud:spring-cloud-function-context | >=3.2.0 <3.2.3 | 3.2.3 |
| GHSA-6v73-fgf6-w5j7 | Maven | org.springframework.cloud:spring-cloud-function-context | <3.1.7 | 3.1.7 |
References
- http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
- https://tanzu.vmware.com/security/cve-2022-22963
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH
- https://www.oracle.com/security-alerts/cpuapr2022.html