요약
- CVE-2022-22947은(는) org.springframework.cloud:spring-cloud-gateway, commerce guided search (oracle), communications cloud native core binding support function (oracle)에 영향을 주는 심각 (CVSS 10.0) 취약점입니다.
- 실제 악용 중: CISA가 16/05/2022에 KEV 목록에 추가했습니다.
- 향후 30일 내 악용 확률(EPSS): 98.3%, 전체 취약점의 99.9%보다 높음.
- 조치: 3.1.1, 3.0.7 이상으로 업데이트하세요.
Description
In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the remote host.
NVD description
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
org.springframework.cloud:spring-cloud-gateway의 다른 취약점
모두 보기 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free