vulnerability
Spring Cloud Function: CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring Expression
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:L/Au:N/C:P/I:P/A:P) | Mar 29, 2022 | Apr 7, 2022 | Aug 26, 2022 |
Severity
9
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
Mar 29, 2022
Added
Apr 7, 2022
Modified
Aug 26, 2022
Description
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Solution
spring-cloud-function-upgrade-latest
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.