Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

CRÍTICO 9.8EXPLOITED (CISA KEV)CVE-2022-22963 · GHSA-6v73-fgf6-w5j7 · Published 01/04/2022 · updated 17/06/2026

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/08/2022. Patch affected systems as an emergency.

Em resumo

CVE-2022-22963 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta org.springframework.cloud:spring-cloud-function-context, banking branch (oracle), banking cash management (oracle).
Explorada ativamente: a CISA a adicionou ao catálogo KEV em 25/08/2022.
Chance de exploração nos próximos 30 dias (EPSS): 99.9%, maior que 100.0% das vulnerabilidades.
Correção: atualize para 3.2.3, 3.1.7 ou posterior.

Package	Affected versions	Patched versions
org.springframework.cloud:spring-cloud-function-context Maven	`≥ 3.2.0, < 3.2.3< 3.1.7`	`3.2.33.1.7`
banking branch oracle	`= 14.5`	No fix yet
banking cash management oracle	`= 14.5`	No fix yet
banking corporate lending process management oracle	`= 14.5`	No fix yet
banking credit facilities process management oracle	`= 14.5`	No fix yet
banking electronic data exchange for corporates oracle	`= 14.5`	No fix yet
banking liquidity management oracle

Description

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

NVD description

References

Mais vulnerabilidades de org.springframework.cloud:spring-cloud-function-context

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free