« Back to list

CVE-2022-22963

Status: AnalyzedCritical (9.8)⚠ Active exploitation

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

CISA KEV — actively exploited

Affected technologies (28)

Oracle — Banking BranchOracle — Banking Cash ManagementOracle — Banking Corporate Lending Process ManagementOracle — Banking Credit Facilities Process ManagementOracle — Banking Electronic Data Exchange FOR CorporatesOracle — Banking Liquidity ManagementOracle — Banking OriginationOracle — Banking Supply Chain FinanceOracle — Banking Trade Finance Process ManagementOracle — Banking Virtual Account ManagementOracle — Communications Cloud Native Core Automated Test SuiteOracle — Communications Cloud Native Core ConsoleOracle — Communications Cloud Native Core Network Exposure FunctionOracle — Communications Cloud Native Core Network Function Cloud Native EnvironmentOracle — Communications Cloud Native Core Network Repository FunctionOracle — Communications Cloud Native Core Network Slice Selection FunctionOracle — Communications Cloud Native Core PolicyOracle — Communications Cloud Native Core Security Edge Protection ProxyOracle — Communications Cloud Native Core Unified Data RepositoryOracle — Communications Communications Policy ManagementOracle — Financial Services Analytical Applications InfrastructureOracle — Financial Services Behavior Detection PlatformOracle — Financial Services Enterprise Case ManagementOracle — Mysql Enterprise MonitorOracle — Product Lifecycle AnalyticsOracle — Retail Xstore Point OF ServiceOracle — Sd-wan EdgeVmware — Spring Cloud Function

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2022-22963",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-22963",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-29T17:53:06.523275Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Spring Cloud Function",
          "versions": [
            {
              "status": "affected",
              "version": "Spring  Cloud Function versions 3.1.6, 3.2.2 and all old and unsupported versions"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-04-01T23:15:13.663",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://tanzu.vmware.com/security/cve-2022-22963",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://tanzu.vmware.com/security/cve-2022-22963",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22963",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@vmware.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-917"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources."
    },
    {
      "lang": "es",
      "value": "En Spring Cloud Function versiones 3.1.6, 3.2.2 y versiones anteriores no soportadas, cuando es usada la funcionalidad routing es posible que un usuario proporcione un SpEL especialmente diseñado como expresión de enrutamiento que puede resultar en la ejecución de código remota y el acceso a recursos locales"
    }
  ],
  "lastModified": "2026-06-17T04:29:15.340",
  "cisaActionDue": "2022-09-15",
  "cisaExploitAdd": "2022-08-25",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "905988BB-71EE-49CE-A73C-FBD4488299D2",
              "versionEndIncluding": "3.1.6"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43C88657-BCAC-40EB-83EB-2FF70F9173A0",
              "versionEndIncluding": "3.2.2",
              "versionStartIncluding": "3.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:banking_branch:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BAE9DFCA-E0C2-420D-86D7-5593F12EE945"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "626C6209-8BC3-4954-BF0C-51500582457E"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6EE231C5-8BF0-48F4-81EF-7186814664CA"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2AA5FF83-B693-4DAB-B585-0FD641266231"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_electronic_data_exchange_for_corporates:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6B6968A-9EB3-46B6-9BD4-735EFED3F869"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_liquidity_management:14.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B7FC2BF9-B6D7-420E-9CF5-21AB770B9CC1"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_liquidity_management:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D5A1417-2C59-431F-BF5C-A2BCFEBC95FD"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_origination:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D6889DD-D320-470C-BA94-165AC79A3AD2"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45AB3A29-0994-46F4-8093-B4A9CE0BD95F"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA4A9041-B9BC-451C-B1BD-4E2FD795BF27"
            },
            {
              "criteria": "cpe:2.3:a:oracle:banking_virtual_account_management:14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2696CD1-9514-405D-A3B3-8308EC1FA571"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4CA84D6-F312-4C29-A02B-050FCB7A902B"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DF6C109-E3D3-431C-8101-2FF88763CF5A"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAAB7154-4DE8-4806-86D0-C1D33B84417B"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_console:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5BB2213-08E7-497F-B672-556FD682D122"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E24426EE-6A3F-413E-A70A-FB98CCD007A1"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2A5B24D-BDF2-423C-98EA-A40778C01A05"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04E6C8E9-2024-496C-9BFD-4548A5B44E2E"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E3221BB-E48E-4B28-B84F-C888EE802A17"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F60E32F-0CA0-4C2D-9848-CB92765A9ACB"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B61A7946-F554-44A9-9E41-86114E4B4914"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AA09838-BF13-46AC-BB97-A69F48B73A8A"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6577F14-36B6-46A5-A1B1-FCCADA61A23B"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4367D9B-BF81-47AD-A840-AC46317C774D"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0425918A-03F1-4541-BDEF-55B03E07E115"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B0C905A-EA99-4B4E-A350-7F6A63CD6EB1"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD4349FE-EEF8-489A-8ABF-5FCD55EC6DE0"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D235B299-9A0E-44FF-84F1-2FFBC070A21D"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6EAA723-2A23-4151-930B-86ACF9CC1C0C"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C2E50B0-64B6-4696-9213-F5D9016058A5"
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "570DB369-A31B-4108-A7FD-09F674129603"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CC69CF0-6269-40F5-871B-16CFD5EC4C45"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "172BECE8-9626-4910-AAA1-A2FA9C7139E3"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4B3A10E-70A8-4332-8567-06AE2C45D3C6"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "059F0D4E-B007-4986-AB95-89F11147CB2B"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6CAC78AD-86BB-4F06-B8CF-8E1329987F2F"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44563108-AD89-49A0-9FA5-7DE5A5601D2C"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FCA5DC3F-E7D8-45E3-8114-2213EC631CDF"
            },
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "078AEFC0-96DA-4F50-BE8E-8360718103A5"
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0EBAC6D-D0CE-42A1-AEA0-2D50C8035747",
              "versionEndIncluding": "8.0.29"
            },
            {
              "criteria": "cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0531C009-B395-4E94-A5F0-A89A152E706B"
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A69FB468-EAF3-4E67-95E7-DF92C281C1F1"
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8AB16F34-D561-498F-A8C3-A24A47BCEBC9"
            },
            {
              "criteria": "cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77E39D5C-5EFA-4FEB-909E-0A92004F2563"
            },
            {
              "criteria": "cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06816711-7C49-47B9-A9D7-FB18CC3F42F2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability"
}