CVE-2022-22963

highPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEPSS 0.999 · 100. PerzentilExploit · waffenfähigDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 32 exploits · waffenfähig

Likely / severe?

99.9% (100th) EPSS

CVSS 7.5 · high

Is it mine?

78 products

Prüfe deine Angriffsfläche

Who says so?

8 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

hinzugefügt 2022-08-25beheben bis 2022-09-15

erforderliche Maßnahme Apply updates per vendor instructions.

EPSS · bewertet 2026-10-27

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenopenshift-serverless-clients-0:1.0.1-2.el8.ppc64le as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1291
Behobenopenshift-serverless-clients-0:1.0.1-2.el8.s390x as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1291
Behobenopenshift-serverless-clients-0:1.0.1-2.el8.src as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1291
Behobenopenshift-serverless-clients-0:1.0.1-2.el8.x86_64 as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1291
Behobenopenshift-serverless-1/client-kn-rhel8@sha256:2199a60cb46225b1551c0882fa0694fa846df5d6e3246f7cfbf6ddf5b55f6b5f_ppc64le as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1292
Behobenopenshift-serverless-1/client-kn-rhel8@sha256:737695f1eb8e271530c86b3cf0bb9abec7075d318785179a4a2bb0fe36676f49_s390x as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1292
Behobenopenshift-serverless-1/client-kn-rhel8@sha256:947bd1823da2b8952018f44e5004cb30ef38e389d6838ab58786528cc93dd53d_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1292
Behobenopenshift-serverless-1/kn-cli-artifacts-rhel8@sha256:407687c6aefdada457416e99c0a60520f2bb999ee558d493679fce2173a130c4_ppc64le as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1292
Behobenopenshift-serverless-1/kn-cli-artifacts-rhel8@sha256:7de6ebb9090b24d23bc3dea51b341f65abcb0660650c9969eebfb42fe9df0397_s390x as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1292
Behobenopenshift-serverless-1/kn-cli-artifacts-rhel8@sha256:b322575e7d8978f54f2534553636410e2b4bd792c2c7c292bc79eaf0ac635bd0_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1292
Workaroundopenshift-serverless-clients-0:1.0.1-2.el8.ppc64le as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-clients-0:1.0.1-2.el8.s390x as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-clients-0:1.0.1-2.el8.src as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-clients-0:1.0.1-2.el8.x86_64 as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/client-kn-rhel8@sha256:2199a60cb46225b1551c0882fa0694fa846df5d6e3246f7cfbf6ddf5b55f6b5f_ppc64le as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/client-kn-rhel8@sha256:737695f1eb8e271530c86b3cf0bb9abec7075d318785179a4a2bb0fe36676f49_s390x as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/client-kn-rhel8@sha256:947bd1823da2b8952018f44e5004cb30ef38e389d6838ab58786528cc93dd53d_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/ingress-rhel8-operator@sha256:2c60dd43650c0bb2a13bc5a0ba73171dc4161df3e8fa877f87fdc77f831e2bef_s390x as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/ingress-rhel8-operator@sha256:4f4b0969b9d4c9b4fa6e69e1eaa827d143f5ea8a1b05a4ea9c9808c1c50b2cb4_ppc64le as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/ingress-rhel8-operator@sha256:843c88275b4730ba15d1e93d01c28ba553c523cd58a193056c6a632726ef1e17_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/kn-cli-artifacts-rhel8@sha256:407687c6aefdada457416e99c0a60520f2bb999ee558d493679fce2173a130c4_ppc64le as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/kn-cli-artifacts-rhel8@sha256:7de6ebb9090b24d23bc3dea51b341f65abcb0660650c9969eebfb42fe9df0397_s390x as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/kn-cli-artifacts-rhel8@sha256:b322575e7d8978f54f2534553636410e2b4bd792c2c7c292bc79eaf0ac635bd0_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/knative-rhel8-operator@sha256:2110904e4790571a74f9438353f08d41625e00d7f4808bb61f1155aef4e9d1ad_s390x as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/knative-rhel8-operator@sha256:7a8dfb4b1c1e37a86759abbcc2816d1192353e9f360a30a379de7e571d9c3e11_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/knative-rhel8-operator@sha256:8c4cc7360f2746bffd5f0e1d0e7f96fc26897972a0b95370873f62f2ac98b76f_ppc64le as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/serverless-operator-bundle@sha256:938f00a46804976a68a1c487499c6df14eb993ed43afd317542a7c998a3278fa_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/serverless-rhel8-operator@sha256:19f7751119b161bd523b42193fed647d657f01f17d934f402de590914f77bdd0_ppc64le as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/serverless-rhel8-operator@sha256:2650be63affb9c84e7cf3f2a8e45322e92a9c59ab1a2a68c07d342a81b405500_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/serverless-rhel8-operator@sha256:8adc78590e58e317ba5b42a026a28a9d84167cf4629448981dc79b3f4fef8a80_s390x as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Kein Fix verfügbarcisco_csaf
No remediation is available at this time.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 5.4–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.15.4mediumAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Lsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HsecondaryAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · OSV

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-917USprimärCWE-497USCWE-74USCWE-770USCWE-917USCWE-94USCWE-94USCWE-94US

ATT&CK-Techniken

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

Exploits (32)

Öffentlicher Proof-of-Concept- und Exploit-Code.

exploit/multi/http/spring_cloud_function_spel_injectionSpring Cloud Function SpEL Injectionwaffenfähig · metasploit
EDB-51577Spring Cloud 3.2.2 - Remote Command Execution (RCE)PoC · exploit_db
808rsec/CVE-2022-22963Simple exploitPoC · poc_in_github
AayushmanThapaMagar/CVE-2022-22963POC for CVE-2022-22963PoC · poc_in_github
BearClaw96/CVE-2022-22963-Poc-BearculesThis is a POC for CVE-2022-22963 PoC · poc_in_github
CyberCTF/vulhub-spring-cve-2022-22963Vulhub spring/CVE-2022-22963: Spring Cloud Function SpEL Injection (CVE-2022-22963), run with IsoloomPoC · poc_in_github

betroffene Produkte (78)

Betroffene Produkte und Versionsbereiche.

JFrog Artifactoryalle Versionencert_bundDEcpe:/a:jfrog:artifactory:-
JFrog Artifactory <7.46.3alle Versionencert_bundDE
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxalle Versionencert_bundDEcpe:/o:suse:suse_linux:-
Ubuntu Linuxalle Versionencert_bundDEcpe:/o:canonical:ubuntu_linux:-
JFrog Artifactory< 7.46.3cert_bundDE
n/a Spring Cloud Function≤ Spring Cloud Function versions 3.1.6, 3.2.2 and all old and unsupported versionsenisa_euvdEU
Pivotal Software Inc. Spring Cloud Function≤ 3.1.7fstec_bduRU
Pivotal Software Inc. Spring Cloud Function≤ 3.2.3fstec_bduRU
oracle banking branch= 14.5nvdUScpe:2.3:a:oracle:banking_branch:*:*:*:*:*:*:*:*
oracle banking cash management= 14.5nvdUScpe:2.3:a:oracle:banking_cash_management:*:*:*:*:*:*:*:*
oracle banking corporate lending process management= 14.5nvdUScpe:2.3:a:oracle:banking_corporate_lending_process_management:*:*:*:*:*:*:*:*
oracle banking credit facilities process management= 14.5nvdUScpe:2.3:a:oracle:banking_credit_facilities_process_management:*:*:*:*:*:*:*:*
oracle banking electronic data exchange for corporates= 14.5nvdUScpe:2.3:a:oracle:banking_electronic_data_exchange_for_corporates:*:*:*:*:*:*:*:*
oracle banking liquidity management= 14.2nvdUScpe:2.3:a:oracle:banking_liquidity_management:*:*:*:*:*:*:*:*
oracle banking liquidity management= 14.5nvdUScpe:2.3:a:oracle:banking_liquidity_management:*:*:*:*:*:*:*:*
oracle banking origination= 14.5nvdUScpe:2.3:a:oracle:banking_origination:*:*:*:*:*:*:*:*
oracle banking supply chain finance= 14.5nvdUScpe:2.3:a:oracle:banking_supply_chain_finance:*:*:*:*:*:*:*:*
oracle banking trade finance process management= 14.5nvdUScpe:2.3:a:oracle:banking_trade_finance_process_management:*:*:*:*:*:*:*:*
oracle banking virtual account management= 14.5nvdUScpe:2.3:a:oracle:banking_virtual_account_management:*:*:*:*:*:*:*:*

20 von 78 angezeigt

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2022:1291Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.21.12022-04-11csaf · redhat_csafUS
Release of OpenShift Serverless Client kn 1.21.1 Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2022:1292Red Hat Security Advisory: Release of OpenShift Serverless 1.21.12022-04-11csaf · redhat_csafUS
Release of OpenShift Serverless 1.21.1 Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2022-1375JFrog Artifactory: Mehrere SchwachstellenDeutsch2022-09-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.
cisco-sa-java-spring-scf-rce-DQrHhJxHVulnerability in Spring Cloud Function Framework Affecting Cisco Products: March 20222022-04-01csaf · cisco_csafUS
On March 29, 2022, the following critical vulnerability in the Spring Cloud Function Framework affecting releases 3.1.6, 3.2.2, and older unsupported releases was disclosed: CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring Expression For a description of this vulnerability, see VMware Spring Framework Security Vulnerability Report ["https://tanzu.vmware.com/security/cve-2022-22963"]. Cisco's Response to This Vulnerability Cisco accessed all products for impact from CVE-2022-22963. To help detect exploitation of this vulnerability, Cisco has released Snort rules at the following location: Talos Rule SID 59388 ["https://www.snort.org/rule_docs/1-59388"] This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH"]
GHSA-6v73-fgf6-w5j7Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression2022-04-03ghsa · osvUS
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund nvd redhat_csaf cisco_csaf osv NVD CVE.org MITRE

veröffentlicht 2022-04-01geändert 2026-06-17

verwandt (254)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-41901US	—OT kritisch	0.43% (37th)	Exploit	2026-05-12
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mech…
CVE-2026-40478US	—OT kritisch	1.10% (66th)	—	2026-04-17
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression…
CVE-2026-40477US	—OT kritisch	0.85% (58th)	Exploit	2026-04-17
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression exec…
CVE-2022-26134US	critical9.8OT kritisch	100.0% (100th)	KEV	2022-06-03
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Conflu…
CVE-2022-22947US	critical10.0OT kritisch	98.3% (100th)	KEV	2022-03-03
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unse…

+249 weitere

Referenzen (34)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan