VMware Spring Cloud Gateway Code Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 16/05/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.cloud:spring-cloud-gateway | ≥ 3.1.0, < 3.1.1< 3.0.7 | 3.1.13.0.7 |
| commerce guided search | = 11.3.2 | |
| communications cloud native core binding support function | = 1.11.0= 22.1.3 | |
| communications cloud native core console | = 22.2.0 | |
| communications cloud native core network exposure function | = 22.1.0 | |
| communications cloud native core network function cloud native environment | = 1.10.0 | |
| communications cloud native core network repository function | = 1.15.0= 1.15.1= 22.1.2= 22.2.0 | |
| communications cloud native core network slice selection function | = 1.8.0= 22.1.0 | |
| communications cloud native core security edge protection proxy | = 22.1.1 | |
| communications cloud native core service communication proxy | = 1.15.0 | |
| spring cloud gateway | = 3.1.0< 3.0.7 | 3.0.7 |
In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the remote host.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free