« Volver al listado

CVE-2022-22963

Estado: AnalizadaCrítica (9.8)⚠ Explotación activa

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector AV:N/AC:L/PR:N/UI:N indica exposición remota sin autenticación. SpEL injection en routing-expression permite RCE (T1059.007) y acceso a recursos locales (T1005). Spring Cloud Function expuesta públicamente.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningRestrict Web-Based ContentPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network Traffic

Tecnologías afectadas (28)

Oracle — Banking BranchOracle — Banking Cash ManagementOracle — Banking Corporate Lending Process ManagementOracle — Banking Credit Facilities Process ManagementOracle — Banking Electronic Data Exchange FOR CorporatesOracle — Banking Liquidity ManagementOracle — Banking OriginationOracle — Banking Supply Chain FinanceOracle — Banking Trade Finance Process ManagementOracle — Banking Virtual Account ManagementOracle — Communications Cloud Native Core Automated Test SuiteOracle — Communications Cloud Native Core ConsoleOracle — Communications Cloud Native Core Network Exposure FunctionOracle — Communications Cloud Native Core Network Function Cloud Native EnvironmentOracle — Communications Cloud Native Core Network Repository FunctionOracle — Communications Cloud Native Core Network Slice Selection FunctionOracle — Communications Cloud Native Core PolicyOracle — Communications Cloud Native Core Security Edge Protection ProxyOracle — Communications Cloud Native Core Unified Data RepositoryOracle — Communications Communications Policy ManagementOracle — Financial Services Analytical Applications InfrastructureOracle — Financial Services Behavior Detection PlatformOracle — Financial Services Enterprise Case ManagementOracle — Mysql Enterprise MonitorOracle — Product Lifecycle AnalyticsOracle — Retail Xstore Point OF ServiceOracle — Sd-wan EdgeVmware — Spring Cloud Function

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-22963",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-22963",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-29T17:53:06.523275Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Spring Cloud Function",
          "versions": [
            {
              "status": "affected",
              "version": "Spring  Cloud Function versions 3.1.6, 3.2.2 and all old and unsupported versions"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-04-01T23:15:13.663",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://tanzu.vmware.com/security/cve-2022-22963",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://tanzu.vmware.com/security/cve-2022-22963",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22963",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@vmware.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-917"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources."
    },
    {
      "lang": "es",
      "value": "En Spring Cloud Function versiones 3.1.6, 3.2.2 y versiones anteriores no soportadas, cuando es usada la funcionalidad routing es posible que un usuario proporcione un SpEL especialmente diseñado como expresión de enrutamiento que puede resultar en la ejecución de código remota y el acceso a recursos locales"
    }
  ],
  "lastModified": "2026-06-17T04:29:15.340",
  "cisaActionDue": "2022-09-15",
  "cisaExploitAdd": "2022-08-25",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "905988BB-71EE-49CE-A73C-FBD4488299D2",
              "versionEndIncluding": "3.1.6"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43C88657-BCAC-40EB-83EB-2FF70F9173A0",
              "versionEndIncluding": "3.2.2",
              "versionStartIncluding": "3.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:banking_branch:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BAE9DFCA-E0C2-420D-86D7-5593F12EE945"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "626C6209-8BC3-4954-BF0C-51500582457E"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6EE231C5-8BF0-48F4-81EF-7186814664CA"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2AA5FF83-B693-4DAB-B585-0FD641266231"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_electronic_data_exchange_for_corporates:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6B6968A-9EB3-46B6-9BD4-735EFED3F869"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_liquidity_management:14.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B7FC2BF9-B6D7-420E-9CF5-21AB770B9CC1"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_liquidity_management:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D5A1417-2C59-431F-BF5C-A2BCFEBC95FD"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_origination:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D6889DD-D320-470C-BA94-165AC79A3AD2"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45AB3A29-0994-46F4-8093-B4A9CE0BD95F"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA4A9041-B9BC-451C-B1BD-4E2FD795BF27"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_virtual_account_management:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2696CD1-9514-405D-A3B3-8308EC1FA571"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4CA84D6-F312-4C29-A02B-050FCB7A902B"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DF6C109-E3D3-431C-8101-2FF88763CF5A"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAAB7154-4DE8-4806-86D0-C1D33B84417B"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_console:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5BB2213-08E7-497F-B672-556FD682D122"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E24426EE-6A3F-413E-A70A-FB98CCD007A1"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2A5B24D-BDF2-423C-98EA-A40778C01A05"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04E6C8E9-2024-496C-9BFD-4548A5B44E2E"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E3221BB-E48E-4B28-B84F-C888EE802A17"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F60E32F-0CA0-4C2D-9848-CB92765A9ACB"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B61A7946-F554-44A9-9E41-86114E4B4914"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AA09838-BF13-46AC-BB97-A69F48B73A8A"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6577F14-36B6-46A5-A1B1-FCCADA61A23B"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4367D9B-BF81-47AD-A840-AC46317C774D"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0425918A-03F1-4541-BDEF-55B03E07E115"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B0C905A-EA99-4B4E-A350-7F6A63CD6EB1"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD4349FE-EEF8-489A-8ABF-5FCD55EC6DE0"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D235B299-9A0E-44FF-84F1-2FFBC070A21D"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6EAA723-2A23-4151-930B-86ACF9CC1C0C"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C2E50B0-64B6-4696-9213-F5D9016058A5"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "570DB369-A31B-4108-A7FD-09F674129603"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CC69CF0-6269-40F5-871B-16CFD5EC4C45"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "172BECE8-9626-4910-AAA1-A2FA9C7139E3"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4B3A10E-70A8-4332-8567-06AE2C45D3C6"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "059F0D4E-B007-4986-AB95-89F11147CB2B"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6CAC78AD-86BB-4F06-B8CF-8E1329987F2F"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44563108-AD89-49A0-9FA5-7DE5A5601D2C"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FCA5DC3F-E7D8-45E3-8114-2213EC631CDF"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "078AEFC0-96DA-4F50-BE8E-8360718103A5"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0EBAC6D-D0CE-42A1-AEA0-2D50C8035747",
              "versionEndIncluding": "8.0.29"
            },
            {
              "criteria": "cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0531C009-B395-4E94-A5F0-A89A152E706B"
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A69FB468-EAF3-4E67-95E7-DF92C281C1F1"
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8AB16F34-D561-498F-A8C3-A24A47BCEBC9"
            },
            {
              "criteria": "cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77E39D5C-5EFA-4FEB-909E-0A92004F2563"
            },
            {
              "criteria": "cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06816711-7C49-47B9-A9D7-FB18CC3F42F2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability"
}