Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

CRITICO 9.8EXPLOITED (CISA KEV)CVE-2022-22963 · GHSA-6v73-fgf6-w5j7 · Published 01/04/2022 · updated 17/06/2026

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/08/2022. Patch affected systems as an emergency.

In breve

CVE-2022-22963 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda org.springframework.cloud:spring-cloud-function-context, banking branch (oracle), banking cash management (oracle).
Sfruttata attivamente: la CISA l'ha aggiunta al catalogo KEV il 25/08/2022.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 99.9%, superiore al 100.0% delle vulnerabilità.
Correzione: aggiornare a 3.2.3, 3.1.7 o successiva.

Package	Affected versions	Patched versions
org.springframework.cloud:spring-cloud-function-context Maven	`≥ 3.2.0, < 3.2.3< 3.1.7`	`3.2.33.1.7`
banking branch oracle	`= 14.5`	No fix yet
banking cash management oracle	`= 14.5`	No fix yet
banking corporate lending process management oracle	`= 14.5`	No fix yet
banking credit facilities process management oracle	`= 14.5`	No fix yet
banking electronic data exchange for corporates oracle	`= 14.5`	No fix yet
banking liquidity management

Description

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

NVD description

References

Altre vulnerabilità di org.springframework.cloud:spring-cloud-function-context

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free