9.8
Critical
CVE-2022-22963 VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-94
Description
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Cloud Function | Versions not published |