CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2022-04-01
Spring Cloud Function SpEL Injection Remote Code Execution Vulnerability (CVE-2022-22963)
[Affected Scope] Spring Cloud Function versions 3.1.6, 3.2.2, and older unsupported versions
[Impact] Unauthenticated remote attackers can inject malicious SpEL expressions via HTTP headers to execute arbitrary system commands and access local resources.
[Mitigation] Immediately upgrade Spring Cloud Function to version 3.1.7, 3.2.3, or higher, and block suspicious routing headers using WAF rules.