CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Spring Cloud Function SpEL Injection Remote Code Execution Vulnerability (CVE-2022-22963)
[Affected Scope] Spring Cloud Function versions 3.1.6, 3.2.2, and older unsupported versions
[Impact] Unauthenticated remote attackers can inject malicious SpEL expressions via HTTP headers to execute arbitrary system commands and access local resources.
[Mitigation] Immediately upgrade Spring Cloud Function to version 3.1.7, 3.2.3, or higher, and block suspicious routing headers using WAF rules.
Spring Data Commons Remote Code Execution (RCE) Vulnerability via SpEL Injection (CVE-2018-1273) Technical Advisory
[Affected Scope] Spring Data Commons versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions.
[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the target server by sending specially crafted HTTP request parameters.
[Mitigation] Immediately upgrade Spring Data Commons to version 1.13.11, 2.0.6, or later, and apply input validation controls.