Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

KRITISCH 9.8EXPLOITED (CISA KEV)CVE-2022-22963 · GHSA-6v73-fgf6-w5j7 · Published 01/04/2022 · updated 17/06/2026

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/08/2022. Patch affected systems as an emergency.

Kurz gesagt

CVE-2022-22963 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in org.springframework.cloud:spring-cloud-function-context, banking branch (oracle), banking cash management (oracle).
Wird aktiv ausgenutzt: CISA hat sie am 25/08/2022 in den KEV-Katalog aufgenommen.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 99.9%, höher als bei 100.0% aller Schwachstellen.
Abhilfe: auf 3.2.3, 3.1.7 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.springframework.cloud:spring-cloud-function-context Maven	`≥ 3.2.0, < 3.2.3< 3.1.7`	`3.2.33.1.7`
banking branch oracle	`= 14.5`	No fix yet
banking cash management oracle	`= 14.5`	No fix yet
banking corporate lending process management oracle	`= 14.5`	No fix yet
banking credit facilities process management oracle	`= 14.5`	No fix yet
banking electronic data exchange for corporates oracle	`= 14.5`	No fix yet
banking liquidity management

Description

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

NVD description

References

Weitere Schwachstellen in org.springframework.cloud:spring-cloud-function-context

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free