CVE-2022-22963
CriticalActively exploited (CISA KEV)
Description
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
SeverityCritical
CVSS9.8
Exploit probability—
Product
VMware Tanzu Spring Cloud
PublishedApr 1, 2022
First seenApr 1, 2022
Added to KEVAug 25, 2022
Weakness typeCWE-94Code injection
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Sep 15, 2022Update
- org.springframework.cloud:spring-cloud-function-context3.2.3, 3.1.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vmware spring_cloud_function | v ≤ 3.1.6, 3.2.0 ≤ v ≤ 3.2.2 | — |
| oracle banking_branch | 14.5 | — |
| oracle banking_cash_management | 14.5 | — |
| oracle banking_corporate_lending_process_management | 14.5 | — |
| oracle banking_credit_facilities_process_management | 14.5 | — |
| oracle banking_electronic_data_exchange_for_corporates | 14.5 | — |
| oracle banking_liquidity_management | 14.2, 14.5 | — |
| oracle banking_origination | 14.5 | — |
| oracle banking_supply_chain_finance | 14.5 | — |
| oracle banking_trade_finance_process_management | 14.5 | — |
| oracle banking_virtual_account_management | 14.5 | — |
| oracle communications_cloud_native_core_automated_test_suite | 1.9.0, 22.1.0 | — |
| oracle communications_cloud_native_core_console | 1.9.0, 22.1.0 | — |
| oracle communications_cloud_native_core_network_exposure_function | 22.1.0 | — |
| oracle communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0, 22.1.0, 22.1.2 | — |
| oracle communications_cloud_native_core_network_repository_function | 1.15.0, 22.1.0 | — |
| oracle communications_cloud_native_core_network_slice_selection_function | 1.8.0, 22.1.0 | — |
| oracle communications_cloud_native_core_policy | 1.15.0, 22.1.0, 22.1.3 | — |
| oracle communications_cloud_native_core_security_edge_protection_proxy | 1.7.0, 22.1.0 | — |
| oracle communications_cloud_native_core_unified_data_repository | 1.15.0, 22.1.0 | — |
| oracle communications_communications_policy_management | 12.6.0.0.0 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.1.1.0, 8.1.2.0 | — |
| oracle financial_services_behavior_detection_platform | 8.1.1.0, 8.1.1.1, 8.1.2.0 | — |
| oracle financial_services_enterprise_case_management | 8.1.1.0, 8.1.1.1, 8.1.2.0 | — |
| oracle mysql_enterprise_monitor | v ≤ 8.0.29 | — |
| oracle product_lifecycle_analytics | 3.6.1.0 | — |
| oracle retail_xstore_point_of_service | 20.0.1, 21.0.0 | — |
| oracle sd-wan_edge | 9.0, 9.1 | — |
| org.springframework.cloud:spring-cloud-function-contextMaven | 3.2.0 ≤ v < 3.2.3, v < 3.1.7 | 3.2.3, 3.1.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.