VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability. Đang bị khai thác thực tế: CISA đưa lỗ hổng này vào danh mục Known Exploited Vulnerabilities ngày 25/08/2022. Hãy vá các hệ thống bị ảnh hưởng ngay.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| org.springframework.cloud:spring-cloud-function-context | ≥ 3.2.0, < 3.2.3< 3.1.7 | 3.2.33.1.7 |
| banking branch | = 14.5 | |
| banking cash management | = 14.5 | |
| banking corporate lending process management | = 14.5 | |
| banking credit facilities process management | = 14.5 | |
| banking electronic data exchange for corporates | = 14.5 | |
| banking liquidity management |
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí= 14.2= 14.5 |
| banking origination | = 14.5 |
| banking supply chain finance | = 14.5 |
| banking trade finance process management | = 14.5 |
| banking virtual account management | = 14.5 |
| communications cloud native core automated test suite | = 1.9.0= 22.1.0 |
| communications cloud native core console | = 1.9.0= 22.1.0 |
| communications cloud native core network exposure function | = 22.1.0 |
| communications cloud native core network function cloud native environment | = 1.10.0= 22.1.0= 22.1.2 |
| communications cloud native core network repository function | = 1.15.0= 22.1.0 |
| communications cloud native core network slice selection function | = 1.8.0= 22.1.0 |
| communications cloud native core policy | = 1.15.0= 22.1.0= 22.1.3 |
| communications cloud native core security edge protection proxy | = 1.7.0= 22.1.0 |
| communications cloud native core unified data repository | = 1.15.0= 22.1.0 |
| communications communications policy management | = 12.6.0.0.0 |
| financial services analytical applications infrastructure | = 8.1.1.0= 8.1.2.0 |
| financial services behavior detection platform | = 8.1.1.0= 8.1.1.1= 8.1.2.0 |
| financial services enterprise case management | = 8.1.1.0= 8.1.1.1= 8.1.2.0 |
| mysql enterprise monitor | ≤ 8.0.29 |
| product lifecycle analytics | = 3.6.1.0 |
| retail xstore point of service | = 20.0.1= 21.0.0 |
| sd-wan edge | = 9.0= 9.1 |
| spring cloud function | ≥ 3.2.0, ≤ 3.2.2≤ 3.1.6 |