CVE-2022-22947

mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.983 · 100 %ileexploit · weaponizedEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 64 exploits · weaponized

Likely / severe?

98.3% (100th) EPSS

CVSS 6.8 · medium

Is it mine?

21 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

added 2022-05-16remediate by 2022-06-06

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-26

VMware Spring Cloud Gateway Code Injection Vulnerability

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.8–10

v2.06.8mediumAV:N/AC:M/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 8.6 · impact 6.4

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 6

v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 6

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · OSV

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-917USprimaryCWE-917USCWE-94USCWE-94USCWE-94US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (64)

Public proof-of-concept and weaponised exploit code.

exploit/linux/http/spring_cloud_gateway_rceSpring Cloud Gateway Remote Code Executionweaponized · metasploit
EDB-50799Spring Cloud Gateway 3.1.0 - Remote Code Execution (RCE)PoC · exploit_db
0730Nophone/CVE-2022-22947-Spring Cloud Gateway Actuator API SpEL表达式注入命令执行（CVE-2022-22947）注入哥斯拉内存马PoC · poc_in_github
0x7eTeam/CVE-2022-22947CVE-2022-22947_EXP,CVE-2022-22947_RCE,CVE-2022-22947反弹shell,CVE-2022-22947 getshellPoC · poc_in_github
22ke/CVE-2022-2294722ke/CVE-2022-22947PoC · poc_in_github
4nNns/CVE-2022-22947Spring-Cloud-Spel-RCEPoC · poc_in_github

affected products (21)

Products and version ranges known to be affected.

n/a Spring cloud Gateway≤ Spring cloud gateway versions 3.1.x prior to 3.1.1+, 3.0.x prior to 3.0.7+ and all old and unsupported versionsenisa_euvdEU
Broadcom Inc. Spring Cloud Gateway≤ 3.1.0fstec_bduRU
Broadcom Inc. Spring Cloud Gateway3.0.0 → 3.0.6fstec_bduRU
oracle commerce guided search= 11.3.2nvdUScpe:2.3:a:oracle:commerce_guided_search:*:*:*:*:*:*:*:*
oracle communications cloud native core binding support function= 1.11.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:*:*:*:*:*:*:*:*
oracle communications cloud native core binding support function= 22.1.3nvdUScpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:*:*:*:*:*:*:*:*
oracle communications cloud native core console= 22.2.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_console:*:*:*:*:*:*:*:*
oracle communications cloud native core network exposure function= 22.1.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:*:*:*:*:*:*:*:*
oracle communications cloud native core network function cloud native environment= 1.10.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:*:*:*:*:*:*:*:*
oracle communications cloud native core network repository function= 1.15.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:*:*:*:*:*:*:*:*
oracle communications cloud native core network repository function= 1.15.1nvdUScpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:*:*:*:*:*:*:*:*
oracle communications cloud native core network repository function= 22.1.2nvdUScpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:*:*:*:*:*:*:*:*
oracle communications cloud native core network repository function= 22.2.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:*:*:*:*:*:*:*:*
oracle communications cloud native core network slice selection function= 1.8.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:*:*:*:*:*:*:*:*
oracle communications cloud native core network slice selection function= 22.1.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:*:*:*:*:*:*:*:*
oracle communications cloud native core security edge protection proxy= 22.1.1nvdUScpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:*:*:*:*:*:*:*:*
oracle communications cloud native core service communication proxy= 1.15.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:*:*:*:*:*:*:*:*
vmware spring cloud gateway< 3.0.7nvdUScpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:*
vmware spring cloud gateway= 3.1.0nvdUScpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:*
Maven org.springframework.cloud:spring-cloud-gateway< 3.0.7osvUSpkg:maven/org.springframework.cloud/spring-cloud-gateway

showing 20 of 21

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-3gx9-37ww-9qw6Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured2022-03-04ghsa · osvUS
In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the remote host.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd osv NVD CVE.org MITRE

published 2022-03-03modified 2026-06-17

related (254)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-41901US	—OT critical	0.43% (37th)	Exploit	2026-05-12
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mech…
CVE-2026-40478US	—OT critical	1.10% (65th)	—	2026-04-17
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression…
CVE-2026-40477US	—OT critical	0.85% (58th)	Exploit	2026-04-17
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression exec…
CVE-2022-26134US	critical9.8OT critical	100.0% (100th)	KEV	2022-06-03
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Conflu…
CVE-2022-22963US	critical9.8OT critical	99.9% (100th)	KEV	2022-04-01
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a r…

+249 more

references (24)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan