CVE-2022-22963

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.999 · 100 %ileexploit · weaponizedDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 32 exploits · weaponized

Likely / severe?

99.9% (100th) EPSS

CVSS 7.5 · high

Is it mine?

78 products

Check your exposure

Who says so?

8 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2022-08-25remediate by 2022-09-15

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-27

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedopenshift-serverless-clients-0:1.0.1-2.el8.ppc64le as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1291
Fixedopenshift-serverless-clients-0:1.0.1-2.el8.s390x as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1291
Fixedopenshift-serverless-clients-0:1.0.1-2.el8.src as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1291
Fixedopenshift-serverless-clients-0:1.0.1-2.el8.x86_64 as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1291
Fixedopenshift-serverless-1/client-kn-rhel8@sha256:2199a60cb46225b1551c0882fa0694fa846df5d6e3246f7cfbf6ddf5b55f6b5f_ppc64le as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1292
Fixedopenshift-serverless-1/client-kn-rhel8@sha256:737695f1eb8e271530c86b3cf0bb9abec7075d318785179a4a2bb0fe36676f49_s390x as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1292
Fixedopenshift-serverless-1/client-kn-rhel8@sha256:947bd1823da2b8952018f44e5004cb30ef38e389d6838ab58786528cc93dd53d_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1292
Fixedopenshift-serverless-1/kn-cli-artifacts-rhel8@sha256:407687c6aefdada457416e99c0a60520f2bb999ee558d493679fce2173a130c4_ppc64le as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1292
Fixedopenshift-serverless-1/kn-cli-artifacts-rhel8@sha256:7de6ebb9090b24d23bc3dea51b341f65abcb0660650c9969eebfb42fe9df0397_s390x as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1292
Fixedopenshift-serverless-1/kn-cli-artifacts-rhel8@sha256:b322575e7d8978f54f2534553636410e2b4bd792c2c7c292bc79eaf0ac635bd0_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index
https://access.redhat.com/errata/RHSA-2022:1292
Workaroundopenshift-serverless-clients-0:1.0.1-2.el8.ppc64le as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-clients-0:1.0.1-2.el8.s390x as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-clients-0:1.0.1-2.el8.src as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-clients-0:1.0.1-2.el8.x86_64 as a component of Red Hat OpenShift Serverless 1.0redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/client-kn-rhel8@sha256:2199a60cb46225b1551c0882fa0694fa846df5d6e3246f7cfbf6ddf5b55f6b5f_ppc64le as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/client-kn-rhel8@sha256:737695f1eb8e271530c86b3cf0bb9abec7075d318785179a4a2bb0fe36676f49_s390x as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/client-kn-rhel8@sha256:947bd1823da2b8952018f44e5004cb30ef38e389d6838ab58786528cc93dd53d_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/ingress-rhel8-operator@sha256:2c60dd43650c0bb2a13bc5a0ba73171dc4161df3e8fa877f87fdc77f831e2bef_s390x as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/ingress-rhel8-operator@sha256:4f4b0969b9d4c9b4fa6e69e1eaa827d143f5ea8a1b05a4ea9c9808c1c50b2cb4_ppc64le as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/ingress-rhel8-operator@sha256:843c88275b4730ba15d1e93d01c28ba553c523cd58a193056c6a632726ef1e17_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/kn-cli-artifacts-rhel8@sha256:407687c6aefdada457416e99c0a60520f2bb999ee558d493679fce2173a130c4_ppc64le as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/kn-cli-artifacts-rhel8@sha256:7de6ebb9090b24d23bc3dea51b341f65abcb0660650c9969eebfb42fe9df0397_s390x as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/kn-cli-artifacts-rhel8@sha256:b322575e7d8978f54f2534553636410e2b4bd792c2c7c292bc79eaf0ac635bd0_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/knative-rhel8-operator@sha256:2110904e4790571a74f9438353f08d41625e00d7f4808bb61f1155aef4e9d1ad_s390x as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/knative-rhel8-operator@sha256:7a8dfb4b1c1e37a86759abbcc2816d1192353e9f360a30a379de7e571d9c3e11_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/knative-rhel8-operator@sha256:8c4cc7360f2746bffd5f0e1d0e7f96fc26897972a0b95370873f62f2ac98b76f_ppc64le as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/serverless-operator-bundle@sha256:938f00a46804976a68a1c487499c6df14eb993ed43afd317542a7c998a3278fa_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/serverless-rhel8-operator@sha256:19f7751119b161bd523b42193fed647d657f01f17d934f402de590914f77bdd0_ppc64le as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/serverless-rhel8-operator@sha256:2650be63affb9c84e7cf3f2a8e45322e92a9c59ab1a2a68c07d342a81b405500_amd64 as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
Workaroundopenshift-serverless-1/serverless-rhel8-operator@sha256:8adc78590e58e317ba5b42a026a28a9d84167cf4629448981dc79b3f4fef8a80_s390x as a component of Red Hat OpenShift Serverless 1.21redhat_csaf
Affected customers should update immediately as soon as patched software is available. There are no other mitigations available at this time.
No fix availablecisco_csaf
No remediation is available at this time.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5.4–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.15.4mediumAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Lsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · OSV

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-917USprimaryCWE-497USCWE-74USCWE-770USCWE-917USCWE-94USCWE-94USCWE-94US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (32)

Public proof-of-concept and weaponised exploit code.

exploit/multi/http/spring_cloud_function_spel_injectionSpring Cloud Function SpEL Injectionweaponized · metasploit
EDB-51577Spring Cloud 3.2.2 - Remote Command Execution (RCE)PoC · exploit_db
808rsec/CVE-2022-22963Simple exploitPoC · poc_in_github
AayushmanThapaMagar/CVE-2022-22963POC for CVE-2022-22963PoC · poc_in_github
BearClaw96/CVE-2022-22963-Poc-BearculesThis is a POC for CVE-2022-22963 PoC · poc_in_github
CyberCTF/vulhub-spring-cve-2022-22963Vulhub spring/CVE-2022-22963: Spring Cloud Function SpEL Injection (CVE-2022-22963), run with IsoloomPoC · poc_in_github

affected products (78)

Products and version ranges known to be affected.

JFrog Artifactoryall versionscert_bundDEcpe:/a:jfrog:artifactory:-
JFrog Artifactory <7.46.3all versionscert_bundDE
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
JFrog Artifactory< 7.46.3cert_bundDE
n/a Spring Cloud Function≤ Spring Cloud Function versions 3.1.6, 3.2.2 and all old and unsupported versionsenisa_euvdEU
Pivotal Software Inc. Spring Cloud Function≤ 3.1.7fstec_bduRU
Pivotal Software Inc. Spring Cloud Function≤ 3.2.3fstec_bduRU
oracle banking branch= 14.5nvdUScpe:2.3:a:oracle:banking_branch:*:*:*:*:*:*:*:*
oracle banking cash management= 14.5nvdUScpe:2.3:a:oracle:banking_cash_management:*:*:*:*:*:*:*:*
oracle banking corporate lending process management= 14.5nvdUScpe:2.3:a:oracle:banking_corporate_lending_process_management:*:*:*:*:*:*:*:*
oracle banking credit facilities process management= 14.5nvdUScpe:2.3:a:oracle:banking_credit_facilities_process_management:*:*:*:*:*:*:*:*
oracle banking electronic data exchange for corporates= 14.5nvdUScpe:2.3:a:oracle:banking_electronic_data_exchange_for_corporates:*:*:*:*:*:*:*:*
oracle banking liquidity management= 14.2nvdUScpe:2.3:a:oracle:banking_liquidity_management:*:*:*:*:*:*:*:*
oracle banking liquidity management= 14.5nvdUScpe:2.3:a:oracle:banking_liquidity_management:*:*:*:*:*:*:*:*
oracle banking origination= 14.5nvdUScpe:2.3:a:oracle:banking_origination:*:*:*:*:*:*:*:*
oracle banking supply chain finance= 14.5nvdUScpe:2.3:a:oracle:banking_supply_chain_finance:*:*:*:*:*:*:*:*
oracle banking trade finance process management= 14.5nvdUScpe:2.3:a:oracle:banking_trade_finance_process_management:*:*:*:*:*:*:*:*
oracle banking virtual account management= 14.5nvdUScpe:2.3:a:oracle:banking_virtual_account_management:*:*:*:*:*:*:*:*

showing 20 of 78

advisories (5)

Vendor and ecosystem advisories describing this.

RHSA-2022:1291Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.21.12022-04-11csaf · redhat_csafUS
Release of OpenShift Serverless Client kn 1.21.1 Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2022:1292Red Hat Security Advisory: Release of OpenShift Serverless 1.21.12022-04-11csaf · redhat_csafUS
Release of OpenShift Serverless 1.21.1 Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2022-1375JFrog Artifactory: Mehrere SchwachstellenDeutsch2022-09-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.
cisco-sa-java-spring-scf-rce-DQrHhJxHVulnerability in Spring Cloud Function Framework Affecting Cisco Products: March 20222022-04-01csaf · cisco_csafUS
On March 29, 2022, the following critical vulnerability in the Spring Cloud Function Framework affecting releases 3.1.6, 3.2.2, and older unsupported releases was disclosed: CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring Expression For a description of this vulnerability, see VMware Spring Framework Security Vulnerability Report ["https://tanzu.vmware.com/security/cve-2022-22963"]. Cisco's Response to This Vulnerability Cisco accessed all products for impact from CVE-2022-22963. To help detect exploitation of this vulnerability, Cisco has released Snort rules at the following location: Talos Rule SID 59388 ["https://www.snort.org/rule_docs/1-59388"] This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH"]
GHSA-6v73-fgf6-w5j7Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression2022-04-03ghsa · osvUS
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd redhat_csaf cisco_csaf osv NVD CVE.org MITRE

published 2022-04-01modified 2026-06-17

related (254)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-41901US	—OT critical	0.43% (37th)	Exploit	2026-05-12
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mech…
CVE-2026-40478US	—OT critical	1.10% (66th)	—	2026-04-17
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression…
CVE-2026-40477US	—OT critical	0.85% (58th)	Exploit	2026-04-17
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression exec…
CVE-2022-26134US	critical9.8OT critical	100.0% (100th)	KEV	2022-06-03
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Conflu…
CVE-2022-22947US	critical10.0OT critical	98.3% (100th)	KEV	2022-03-03
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unse…

+249 more

references (34)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan