Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

CRITIQUE 9.8EXPLOITED (CISA KEV)CVE-2022-22963 · GHSA-6v73-fgf6-w5j7 · Published 01/04/2022 · updated 17/06/2026

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/08/2022. Patch affected systems as an emergency.

En bref

CVE-2022-22963 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant org.springframework.cloud:spring-cloud-function-context, banking branch (oracle), banking cash management (oracle).
Exploitée activement : la CISA l'a ajoutée au catalogue KEV le 25/08/2022.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 99.9%, plus élevée que 100.0% des vulnérabilités.
Correctif : mettre à jour vers 3.2.3, 3.1.7 ou plus récent.

Package	Affected versions	Patched versions
org.springframework.cloud:spring-cloud-function-context Maven	`≥ 3.2.0, < 3.2.3< 3.1.7`	`3.2.33.1.7`
banking branch oracle	`= 14.5`	No fix yet
banking cash management oracle	`= 14.5`	No fix yet
banking corporate lending process management oracle	`= 14.5`	No fix yet
banking credit facilities process management oracle	`= 14.5`	No fix yet
banking electronic data exchange for corporates oracle	`= 14.5`	No fix yet
banking liquidity management

Description

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

NVD description

References

Autres vulnérabilités de org.springframework.cloud:spring-cloud-function-context

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free