CVE-2022-22963

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

Spring Cloud Function

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

2. Apr 2022

Ausgewertete Quellen

• Hersteller
  https://tanzu.vmware.com/security/cve-2022-22963
• Hinweis
  http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html
• Hinweis
  https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
• Hinweis
  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH
• Hinweis
  https://www.oracle.com/security-alerts/cpuapr2022.html
• Hinweis
  https://www.oracle.com/security-alerts/cpujul2022.html
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22963
• CISA
  VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
• NVD
  CVE-2022-22963