vulnerability
Spring Cloud Function: CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring Expression
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:L/Au:N/C:P/I:P/A:P) | Mar 29, 2022 | Apr 7, 2022 | Aug 26, 2022 |
Severity
9
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
Mar 29, 2022
Added
Apr 7, 2022
Modified
Aug 26, 2022
Description
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Solution
spring-cloud-function-upgrade-latest
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.