Skip to content
Sign in
Not rated

CVE-2022-22946 In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store…

Description

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates.

Affected products and versions

Product Affected versions Fixed in
Spring Cloud Gateway Versions not published

Other CVEs of Spring Cloud Gateway

The 3 CVEs of Spring Cloud Gateway →
CVE-2022-22947 VMware Spring Cloud Gateway Code Injection Vulnerability 10.0 Critical CVE-2021-22051 Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request… Not rated
Track this CVE