CVE-2022-22947: VMware Spring Cloud Gateway Code Injection Vulnerability

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-05-16
EPSS: 98.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-03 · updated 2026-06-17
Weakness: CWE-94

Description

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Affected products

Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
Oracle Communications Cloud Native Core Binding Support Function: 1.11.0, 22.1.3
Oracle Communications Cloud Native Core Console: 22.2.0
Oracle Communications Cloud Native Core Network Exposure Function: 22.1.0
Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 1.10.0
Oracle Communications Cloud Native Core Network Repository Function: 1.15.0, 1.15.1, 22.1.2, 22.2.0
Oracle Communications Cloud Native Core Network Slice Selection Function: 1.8.0, 22.1.0
Oracle Communications Cloud Native Core Security Edge Protection Proxy: 22.1.1
Oracle Communications Cloud Native Core Service Communication Proxy: 1.15.0
Spring Cloud Gateway: before 3.0.7; 3.1.0 — fixed in 3.0.7
Spring Cloud Gateway: from Spring cloud gateway versions 3.1.x prior through 3.1.1+, 3.0.x prior to 3.0.7+ and all old and unsupported versions

How to fix

Upgrade to a fixed version: Spring Cloud Gateway 3.0.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-22947 or the next vulnerability affects your stack