CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2022-22947

CVSS 10.0v3.1pub. 2022-03-03upd. 2025-10-30

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Oracle Commerce Guided Search

    APP
    Oracle
    11.3.2

  • Oracle Communications Cloud Native Core Binding Support Function

    APP
    Oracle
    1.11.022.1.3

  • Oracle Communications Cloud Native Core Console

    APP
    Oracle
    22.2.0

  • Oracle Communications Cloud Native Core Network Exposure Function

    APP
    Oracle
    22.1.0

  • Oracle Communications Cloud Native Core Network Function Cloud Native Environment

    APP
    Oracle
    1.10.0

  • Oracle Communications Cloud Native Core Network Repository Function

    APP
    Oracle
    1.15.01.15.122.1.222.2.0

  • Oracle Communications Cloud Native Core Network Slice Selection Function

    APP
    Oracle
    1.8.022.1.0

  • Oracle Communications Cloud Native Core Security Edge Protection Proxy

    APP
    Oracle
    22.1.1

  • Oracle Communications Cloud Native Core Service Communication Proxy

    APP
    Oracle
    1.15.0

  • VMware Spring Cloud Gateway

    APP
    Vmware
    3.1.0< 3.0.7

CISA KEV — detailsi

Vendori
VMware ↗
Producti
Spring Cloud Gateway
Added to KEVi
May 16, 2022
Remediation deadline (US Federal)i
June 6, 2022(overdue)
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 6 czerwca 2022
CWE
References

Related vulnerabilities

CVE-2022-22963CRITICAL9.8⚠ KEVPL ✓same product

RCE w Spring Cloud Function poprzez złośliwy SpEL routing-expression

CVE-2022-22965CRITICAL9.8⚠ KEVPL ✓same product

Spring4Shell — RCE przez data binding w Spring MVC/WebFlux na JDK 9+

CVE-2026-70976CRITICAL9.1same product

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Comm...

CVE-2026-70977CRITICAL9.1same product

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Comm...

CVE-2026-70978CRITICAL9.1same product

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Comm...