Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

CRÍTICO 9.8EXPLOITED (CISA KEV)CVE-2022-22963 · GHSA-6v73-fgf6-w5j7 · Published 01/04/2022 · updated 17/06/2026

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/08/2022. Patch affected systems as an emergency.

En resumen

CVE-2022-22963 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a org.springframework.cloud:spring-cloud-function-context, banking branch (oracle), banking cash management (oracle).
Explotada activamente: CISA la añadió al catálogo KEV el 25/08/2022.
Probabilidad de explotación en los próximos 30 días (EPSS): 99.9%, mayor que el 100.0% de las vulnerabilidades.
Solución: actualizar a 3.2.3, 3.1.7 o posterior.

Package	Affected versions	Patched versions
org.springframework.cloud:spring-cloud-function-context Maven	`≥ 3.2.0, < 3.2.3< 3.1.7`	`3.2.33.1.7`
banking branch oracle	`= 14.5`	No fix yet
banking cash management oracle	`= 14.5`	No fix yet
banking corporate lending process management oracle	`= 14.5`	No fix yet
banking credit facilities process management oracle	`= 14.5`	No fix yet
banking electronic data exchange for corporates oracle	`= 14.5`	No fix yet
banking liquidity management

Description

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

NVD description

References

Más vulnerabilidades de org.springframework.cloud:spring-cloud-function-context

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free