← CVE Radar
CVE-2022-22947VMware Spring Cloud Gateway Code Injection Vulnerability
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
10.0 CRITICALEPSS 98.25%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 10.0 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 6.8 | MEDIUM | 2.0NVD | AV:N/AC:M/Au:N/C:P/I:P/A:P |
CISA required action
⚡ Known exploited · remediation due Jun 6, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2022-22947
- Status
- Analyzed
- Assigner (CNA)
- vmware
- Published
- Mar 3, 2022
- Last modified
- 2026-06-17 04:29 UTC
Affected Products
As published by the CNA in the CVE record.
Spring Cloud Gateway1 version range
- Spring cloud gateway versions 3.1.x prior to 3.1.1+, 3.0.x prior to 3.0.7+ and all old and unsupported versions
References
- packetstormsecurity.com http://packetstormsecurity.com/files/166219/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html
- packetstormsecurity.com http://packetstormsecurity.com/files/168742/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html
- tanzu.vmware.com https://tanzu.vmware.com/security/cve-2022-22947
- oracle.com https://www.oracle.com/security-alerts/cpuapr2022.html
- oracle.com https://www.oracle.com/security-alerts/cpujul2022.html
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22947