[ CVE-2022-22947 · Published 3 Mar 2022 ]
VMware Spring Cloud Gateway Code Injection Vulnerability
Exploited · CISA KEV CVSS 10.0
EPSS 98%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-05-16
- EPSS: 98% chance of exploitation in the next 30 days (higher than 100% of CVEs)
- Critical severity: CVSS 10.0
[ Description ]Official description
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
CISA: Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 6 Jun 2022): Apply updates per vendor instructions.
- Patch on oracle.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on oracle.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- packetstormsecurity.com/files/166219/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/168742/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- tanzu.vmware.com/security/cve-2022-22947MitigationVendor Advisory
- www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- www.oracle.com/security-alerts/cpujul2022.htmlPatchThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource