CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2022-22963

CVSS 9.8v3.1pub. 2022-04-01upd. 2025-10-30

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Oracle Banking Branch
APP
Oracle
14.5
Oracle Banking Cash Management
APP
Oracle
14.5
Oracle Banking Corporate Lending Process Management
APP
Oracle
14.5
Oracle Banking Credit Facilities Process Management
APP
Oracle
14.5
Oracle Banking Electronic Data Exchange For Corporates
APP
Oracle
14.5
Oracle Banking Liquidity Management
APP
Oracle
14.214.5
Oracle Banking Origination
APP
Oracle
14.5
Oracle Banking Supply Chain Finance
APP
Oracle
14.5
Oracle Banking Trade Finance Process Management
APP
Oracle
14.5
Oracle Banking Virtual Account Management
APP
Oracle
14.5
Oracle Communications Cloud Native Core Automated Test Suite
APP
Oracle
1.9.022.1.0
Oracle Communications Cloud Native Core Console
APP
Oracle
1.9.022.1.0
Oracle Communications Cloud Native Core Network Exposure Function
APP
Oracle
22.1.0
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
APP
Oracle
1.10.022.1.022.1.2
Oracle Communications Cloud Native Core Network Repository Function
APP
Oracle
1.15.022.1.0
Oracle Communications Cloud Native Core Network Slice Selection Function
APP
Oracle
1.8.022.1.0
Oracle Communications Cloud Native Core Policy
APP
Oracle
1.15.022.1.022.1.3
Oracle Communications Cloud Native Core Security Edge Protection Proxy
APP
Oracle
1.7.022.1.0
Oracle Communications Cloud Native Core Unified Data Repository
APP
Oracle
1.15.022.1.0
Oracle Communications Communications Policy Management
APP
Oracle
12.6.0.0.0
Oracle Financial Services Analytical Applications Infrastructure
APP
Oracle
8.1.1.08.1.2.0
Oracle Financial Services Behavior Detection Platform
APP
Oracle
8.1.1.08.1.1.18.1.2.0
Oracle Financial Services Enterprise Case Management
APP
Oracle
8.1.1.08.1.1.18.1.2.0
Oracle MySQL Enterprise Monitor
APP
Oracle
≤ 8.0.29
Oracle Product Lifecycle Analytics
APP
Oracle
3.6.1.0
Oracle Retail Xstore Point Of Service
APP
Oracle
20.0.121.0.0
Oracle Sd Wan Edge
APP
Oracle
9.09.1
VMware Spring Cloud Function
APP
Vmware
≤ 3.1.63.2.0 – 3.2.2

CISA KEV — detailsi

Vendori: VMware Tanzu
Producti: Spring Cloud
Added to KEVi: August 25, 2022
Remediation deadline (US Federal)i: September 15, 2022(overdue)

🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

🔴