CVE Vulnerability Advisory Database

Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.

Showing 1–1 of 1 advisories (Page 1/1)

CVE-2022-2294710.0/CRITICALEPSS 98.3%CISA KEV

2022-03-03

Spring Cloud Gateway Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2022-22947)

[Affected Scope] Spring Cloud Gateway versions prior to 3.1.1 and 3.0.7, where the Gateway Actuator endpoint is enabled, exposed, and unsecured

[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host by sending maliciously crafted HTTP requests

[Mitigation] Immediately upgrade Spring Cloud Gateway to version 3.1.1, 3.0.7, or higher, and disable or secure the Gateway Actuator endpoint