Skip to content
Sign in
10.0 Critical

CVE-2022-22947 VMware Spring Cloud Gateway Code Injection Vulnerability

Active exploitation observed

· CISA KEV catalogue
Required action Apply updates per vendor instructions.
Ransomware campaigns Not observed so far
Weakness CWE-94

Description

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Affected products and versions

Product Affected versions Fixed in
Spring Cloud Gateway Versions not published

Other CVEs of Spring Cloud Gateway

The 3 CVEs of Spring Cloud Gateway →
CVE-2022-22946 In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store… Not rated CVE-2021-22051 Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request… Not rated
Track this CVE