Aller au contenu
Se connecter
10.0 Critique

CVE-2022-22947 VMware Spring Cloud Gateway Code Injection Vulnerability

Exploitation active constatée

· catalogue CISA KEV
Action attendue Apply updates per vendor instructions.
Campagnes de rançongiciel Non constatée à ce jour
Faiblesse CWE-94

Description

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Produits et versions touchés

Produit Versions touchées Corrigé en
Spring Cloud Gateway Versions non publiées

Autres CVE de Spring Cloud Gateway

Les 3 CVE de Spring Cloud Gateway →
CVE-2022-22946 In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store… Non notée CVE-2021-22051 Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request… Non notée
Suivre cette CVE