VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/08/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.cloud:spring-cloud-function-context | ≥ 3.2.0, < 3.2.3< 3.1.7 | 3.2.33.1.7 |
| banking branch | = 14.5 | |
| banking cash management | = 14.5 | |
| banking corporate lending process management | = 14.5 | |
| banking credit facilities process management | = 14.5 | |
| banking electronic data exchange for corporates | = 14.5 | |
| banking liquidity management | = 14.2= 14.5 |
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free| banking origination | = 14.5 |
| banking supply chain finance | = 14.5 |
| banking trade finance process management | = 14.5 |
| banking virtual account management | = 14.5 |
| communications cloud native core automated test suite | = 1.9.0= 22.1.0 |
| communications cloud native core console | = 1.9.0= 22.1.0 |
| communications cloud native core network exposure function | = 22.1.0 |
| communications cloud native core network function cloud native environment | = 1.10.0= 22.1.0= 22.1.2 |
| communications cloud native core network repository function | = 1.15.0= 22.1.0 |
| communications cloud native core network slice selection function | = 1.8.0= 22.1.0 |
| communications cloud native core policy | = 1.15.0= 22.1.0= 22.1.3 |
| communications cloud native core security edge protection proxy | = 1.7.0= 22.1.0 |
| communications cloud native core unified data repository | = 1.15.0= 22.1.0 |
| communications communications policy management | = 12.6.0.0.0 |
| financial services analytical applications infrastructure | = 8.1.1.0= 8.1.2.0 |
| financial services behavior detection platform | = 8.1.1.0= 8.1.1.1= 8.1.2.0 |
| financial services enterprise case management | = 8.1.1.0= 8.1.1.1= 8.1.2.0 |
| mysql enterprise monitor | ≤ 8.0.29 |
| product lifecycle analytics | = 3.6.1.0 |
| retail xstore point of service | = 20.0.1= 21.0.0 |
| sd-wan edge | = 9.0= 9.1 |
| spring cloud function | ≥ 3.2.0, ≤ 3.2.2≤ 3.1.6 |