9.8
Critique
CVE-2022-22963 VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply updates per vendor instructions.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-94
Description
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Cloud Function | Versions non publiées |